Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80622— char: tlclk: fix use-after-free in tlclk_cleanup()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： char: tlclk: 修复 tlclk_cleanup() 中的释放后使用（use-after-free）问题 该补丁改进了 tlclk 驱动中的模块清理流程，以防止潜在的释放后使用和竞态条件。 目前， 结构体未设置 字段，这可能导致模块在用户空间进程仍与设备交互时被卸载。此外， 函数在确保等待队列中被阻塞的进程完全唤醒以及 完成之前就释放了 内存。 为解决这些问题，该补丁执行了以下操作： 在 中设置 ，以便在设备使用期间安全地延迟模块卸载。 更新 ，使其显式唤醒所

CVSS 7.8 · High EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1059.003 · Windows Command Shell

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1a80ba88273097933f93b1f40537337416798c70< 09d8d2a46a9ec9ff728f3159a174a2ab25dd0f0a affected
1a80ba88273097933f93b1f40537337416798c70< 96902299a22d126ef5eb3f45cd5d8ceea9e6a735 affected
1a80ba88273097933f93b1f40537337416798c70< 166dd1d5265e067459e674c11688919901813ec2 affected
1a80ba88273097933f93b1f40537337416798c70< 764723bd67a6c8f53a8d8309211fb039e2ebcf49 affected
1a80ba88273097933f93b1f40537337416798c70< c3f0cd76561ae611c2d247ee96dfd559e4197cb7 affected
1a80ba88273097933f93b1f40537337416798c70< 3d5e4cc0d9dce79b0429da3134ac7b072ab9009f affected
1a80ba88273097933f93b1f40537337416798c70< 42223445607a9a5df3cb1c4729abfe3a5085e7ce affected
1a80ba88273097933f93b1f40537337416798c70< bbf003b7794d6ad6f939fdd29f1f1bde8ac554c1 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80622

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
char: tlclk: fix use-after-free in tlclk_cleanup()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk_cleanup() This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the file_operations structure does not specify the .owner field, which could allow the module to be unloaded while user-space processes are still interacting with the device. Additionally, the tlclk_cleanup() function frees the alarm_events memory before ensuring that blocked processes in the waitqueue are fully awakened and that the switchover_timer has completed. To address these cases, this patch: - Sets '.owner = THIS_MODULE' in tlclk_fops to safely defer module unloading while the device is in use. - Updates tlclk_cleanup() to explicitly wake up all blocked readers (wake_up_all), properly release hardware I/O regions, and safely delete the timer (timer_delete_sync) prior to freeing memory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1a80ba88273097933f93b1f40537337416798c70 ~ 09d8d2a46a9ec9ff728f3159a174a2ab25dd0f0a -
Linux Linux 2.6.15 -

II. Public POCs for CVE-2026-80622

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80622

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80622 (8)

Same Patch Batch · Linux · 2026-08-28 · 135 CVEs total

CVE-2026-80634 9.8 CRITICAL netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
CVE-2026-80694 9.8 CRITICAL net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
CVE-2026-80681 9.8 CRITICAL vxlan: re-fetch eth header after route_shortcircuit()
CVE-2026-80674 9.8 CRITICAL ntfs: validate resident attribute lists and harden the validator
CVE-2026-80673 9.8 CRITICAL ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()
CVE-2026-80668 9.8 CRITICAL netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
CVE-2026-80630 9.8 CRITICAL net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restorin
CVE-2026-80617 9.8 CRITICAL net: airoha: fix foe_check_time allocation size
CVE-2026-80612 9.8 CRITICAL net: lwtunnel: Drop skb metadata before LWT encapsulation
CVE-2026-80714 9.8 CRITICAL ipvs: do not propagate one-packet flag to synced conns
CVE-2026-80609 9.8 CRITICAL qede: fix out-of-bounds check for cqe->len_list[]
CVE-2026-80600 9.8 CRITICAL batman-adv: dat: acquire ARP hw source only after skb realloc
CVE-2026-80693 9.3 CRITICAL idpf: bound interrupt-vector register fill to the allocated array
CVE-2026-80684 9.3 CRITICAL KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
CVE-2026-80671 9.3 CRITICAL perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
CVE-2026-80603 9.1 CRITICAL netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
CVE-2026-80670 9.1 CRITICAL perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
CVE-2026-80721 8.8 HIGH Bluetooth: ISO: ensure no dangling hcon references in iso_conn
CVE-2026-80722 8.8 HIGH wifi: mac80211: validate individual TWT params before driver setup
CVE-2026-80724 8.8 HIGH ptp: vmclock: prevent read-only mappings from becoming writable

Showing top 20 of 135 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80622

No comments yet

Leave a comment