CVE-2026-80947 Linux kernel CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that use the rtl8xxxu driver should be aware of this vulnerability. They should verify Linux kernel versions and assess exposure of Linux-based systems that use the rtl8xxxu driver. They should also monitor the Linux kernel's vulnerability management process for updates on this issue.

Why it matters

A use-after-free vulnerability in the Linux kernel's rtl8xxxu driver can lead to a crash or potentially allow an attacker to execute arbitrary code. The vulnerability requires verification of Linux kernel versions and exposure assessment of Linux-based systems that use the rtl8xxxu driver.

• Verify that Linux kernel versions used in your organization are updated with the fix.
• Assess exposure of Linux-based systems that use the rtl8xxxu driver.
• Monitor Linux kernel vulnerability management process for updates on this issue.

Technical summary

The rtl8xxxu driver in the Linux kernel has a use-after-free vulnerability. The bug occurs when the rx_urb_wq worker is not properly canceled during the stop process, allowing it to run after the device has been disconnected and the private data has been freed. This can lead to a use-after-free error when the worker tries to access the freed private data. The vulnerability requires verification of Linux kernel versions and exposure assessment of Linux-based systems that use the rtl8xxxu driver. The fix involves updating the Linux kernel to a version that includes the patch.

Defensive priority

High

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers to fix the vulnerability.
• Ensure that the Linux kernel is updated to a version that includes the fix.
• Monitor the Linux kernel's vulnerability management process for updates on this issue.
• Verify that Linux kernel versions used in your organization are updated with the fix.
• Assess exposure of Linux-based systems that use the rtl8xxxu driver.
• Monitor Linux kernel vulnerability management process for updates on this issue.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was found by static analysis. The CVE record and NVD entry provide details about the vulnerability. Linux kernel developers should verify Linux kernel versions and assess exposure of Linux-based systems that use the rtl8xxxu driver. The fix involves updating the Linux kernel to a version that includes the patch. The vulnerability allows an attacker to potentially execute arbitrary code or cause a system crash. There is no information about exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.