CVE-2026-80923

A flaw was found in the Linux kernel. When the tty_register_driver() function fails, the global dbc_tty_driver pointer is not properly cleared. This can lead to a use-after-free vulnerability during module unload, where the system attempts to unregister an already freed driver, potentially causing system instability or denial of service.

This vulnerability is rated as Moderate for Red Hat Enterprise Linux because triggering the flaw requires an unusual failure during driver initialization followed by a subsequent module unload, restricting the impact to local denial of service. In typical enterprise environments, unloading core USB host controller modules is an uncommon maintenance operation restricted to privileged administrators with CAP_SYS_MODULE capabilities. Consequently, unprivileged local users and remote attackers cannot exploit this condition to compromise system integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.