CVE-2026-80611 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and verify patched versions to prevent potential issues. They should also monitor system logs for RCU warnings during idle entry and review compensating controls for exposed systems. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence

Why it matters

A Linux kernel vulnerability has been resolved, which triggered an RCU warning when function tracing or Kprobes was enabled and entering an ACPI Low Power Idle (LPI) state. Linux kernel maintainers and users should assess exposure and verify patched versions.

• Verify patched Linux kernel versions to prevent RCU warnings during idle entry.
• Monitor system logs for RCU warnings to detect potential issues.

Technical summary

The Linux kernel vulnerability triggered an RCU warning when function tracing or Kprobes was enabled and entering an ACPI Low Power Idle (LPI) state. The fix annotates specific functions with __cpuidle to disable ftrace instrumentation, preventing RCU warnings during idle entry. This change ensures that the cpuidle path is properly handled, and ftrace does not interfere with it. The affected functions are moved into the '.cpuidle.text' section, implicitly disabling ftrace instrumentation along this sensitive path and preventing trace-induced RCU warnings during idle entry.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patched versions.

Recommended defensive actions

• Assess exposure by checking Linux kernel versions and configurations.
• Verify patched versions by updating to the latest Linux kernel release.
• Monitor system logs for RCU warnings during idle entry.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix. Multiple source references from the Linux kernel Git repository are available, including specific commits and patches that address the issue. The vulnerability was introduced due to the lack of __cpuidle annotation on functions entering the LPI state, which caused RCU warnings when function tracing or Kprobes were enabled. The fix involves adding the __cpuidle annotation to the affected functions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.