CVE-2026-80622

A flaw was found in the Linux kernel's tlclk driver. This vulnerability occurs due to improper module cleanup, where the driver can be unloaded while user-space processes are still active, and memory is freed prematurely. This can lead to a use-after-free condition and race conditions. A local attacker could potentially exploit this to cause a denial of service or achieve privilege escalation.

A moderate use-after-free vulnerability was found in the Linux kernel tlclk driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10 and the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2. The tlclk driver's file_operations structure did not set the .owner field, which allowed the module to be unloaded while user-space processes were still interacting with the device, and tlclk_cleanup() freed the alarm_events memory before all processes blocked on the waitqueue were awakened and before the switchover timer had completed. A local attacker able to access the tlclk device could exploit this race condition during module unload to cause a kernel panic, resulting in a denial of service. Red Hat rated this flaw Moderate (CVSS 5.5) because the demonstrated impact is limited to availability and reliably triggering the race is complex; this is lower than the upstream Important rating (CVSS 7.8), which assumes full confidentiality and integrity impact. Fixes for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams are currently deferred, leaving a residual risk of local denial of service on systems where the tlclk module is loaded and unloaded while in use. The Red Hat Enterprise Linux 6 stream is out of support (OOSS) and is not scheduled to receive a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.