CVE-2026-80623 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel configurations, especially for ACPI systems using Coresight, should assess exposure and prioritize verification of save_state settings and Coresight device configurations to ensure proper settings and mitigate potential issues. This includes reviewing Coresight device configurations for concurrent probing issues and verifying Linux kernel configurations for ACPI systems using Coresight.

Why it matters

Defenders should assess exposure and prioritize verification of Linux kernel configurations, especially for ACPI systems using Coresight, to ensure proper save_state settings and mitigate potential issues.

• Verification of Linux kernel configurations for ACPI systems using Coresight
• Assessment of save_state settings for system register ETMs and ETE
• Review of Coresight device configurations for concurrent probing issues

Technical summary

The Linux kernel vulnerability CVE-2026-80623 was resolved by ensuring that the state is saved on power down for system register ETMs and ETE. This fix addresses an issue with Coresight on ACPI systems, preventing potential problems with concurrent probing when devices have different configurations. The resolution involves hardcoding the setting for sysreg ETMs and ETE or ACPI boots, and using a local variable when setting up save_state. This change impacts Linux kernel configurations, especially for ACPI systems using Coresight, and requires verification of save_state settings and Coresight device configurations.

Defensive priority

Defenders should assess exposure and prioritize verification of Linux kernel configurations, especially for ACPI systems using Coresight.

Recommended defensive actions

• Assess Linux kernel configurations for ACPI systems using Coresight
• Verify save_state settings for system register ETMs and ETE
• Review Coresight device configurations for concurrent probing issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability. Linux kernel references are available for technical analysis. The resolution involves hardcoding the setting for sysreg ETMs and ETE or ACPI boots, and using a local variable when setting up save_state to prevent concurrent probing issues. The fix ensures that the state is saved on power down for system register ETMs and ETE. This change impacts Linux kernel configurations, especially for ACPI systems using Coresight.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.