CVE-2026-80661 — AI Deep Analysis Summary

🚨 **Root Cause**: The UFS driver trace code **dereferences a potentially stale pointer** in `TP_printk()`. 📉 **Impact**: When reading `/sys/kernel/tracing/trace`, if the HBA memory has been freed, it can cause a **Kernel…

🔍 **Flaw Location**: The tracepoint in `drivers/ufs/core/ufs_trace.h` passes the HBA pointer, but the print function executes with a delay. 🧩 **CWE**: **CWE-416** (Use After Free) / **CWE-417** (Disposal Without Release)…

🖥️ **Component**: Linux Kernel UFS Subsystem (`drivers/ufs/core`). 📦 **Version**: All kernel versions containing this UFS tracing code (specific versions require checking Git commit history; typically affects newer kerne…

👤 **Attacker Capabilities**: - **Privileges**: Requires permission to read `/sys/kernel/tracing/trace` (typically root or possessing `CAP_SYS_ADMIN`). - **Data**: Primarily leads to **Availability (DoS)**, i.e., system c…

🚪 **Barriers**: - **Authentication**: Requires system administrator privileges or specific capabilities. - **Configuration**: Requires kernel tracing functionality to be enabled. - **Difficulty**: Moderate; requires cons…

📝 **PoC/Exp**: - **PoC**: The `pocs` list is currently empty in the data; no ready-made public Exp available. - **In-the-Wild Exploits**: No known in-the-wild exploit records have been found; this is an issue discovered …

🔎 **Self-Check Method**: 1. Check the kernel source code in `drivers/ufs/core/ufs_trace.h`. 2. Confirm whether `TP_printk()` directly dereferences the HBA pointer. 3.…

✅ **Official Fix**: - **Patch**: Fixed. Modified to **directly copy the device name** into the ring buffer when the tracepoint is called, avoiding delayed dereferencing. - **Commit**: See Git link (e.g., 2510434307a22407…

🛡️ **Temporary Workarounds**: - **Disable Tracing**: Disable functionality related to `/sys/kernel/tracing`. - **Avoid Reading**: Before the patch is applied, avoid reading the trace file immediately after a UFS device i…

⏱️ **Priority**: - **Level**: **Low-Medium**. - **Reason**: Trigger conditions are strict (specific timing + privileges), and there are no in-the-wild exploit records. - **Recommendation**: Can be handled within the regu…