CVE-2026-80659

A flaw was found in the Linux kernel's vub300 driver. When the vub300_cmndwork_thread() function holds a command mutex and a command response times out, the device reset path attempts to re-acquire the same mutex recursively. This recursive locking can lead to a deadlock, causing a Denial of Service (DoS) condition for the system.

A low impact flaw was found in the Linux kernel vub300 USB MMC host driver, affecting Red Hat Enterprise Linux 7 through 10 and Red Hat In-Vehicle OS. When a command response times out while vub300_cmndwork_thread() holds cmd_mutex, __vub300_command_response() kills the command URBs and synchronously resets the USB device through usb_reset_device(). That reset path re-enters the driver via vub300_pre_reset(), which attempts to acquire cmd_mutex again while it is still held by the same task, deadlocking the command worker and leaving the MMC request path hung, resulting in a local denial of service. Confidentiality and integrity are not affected and there is no evidence of memory corruption or privilege escalation. Triggering the flaw requires a VUB300 USB MMC device to be present and a command response timeout to occur, so systems without such hardware are not exposed to this code path. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present. For the affected streams the fix is currently deferred; the residual risk is limited to a hung kernel workqueue thread causing local denial of service on systems using this specific USB MMC hardware. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact of this flaw as low because it is not network reachable, requires this specific USB hardware, and only causes local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.