Linux Kernel CVE-2026-80661

Exploitation requires all of the following: (1) The host system must have a UFS storage device physically present and the UFS kernel driver loaded. (2) The attacker must have local access with read permissions to /sys/kernel/tracing/trace, which typically requires CAP_SYS_ADMIN or membership in the tracing group depending on distribution configuration. (3) A UFS trace event must be captured in the ring buffer while the hba object is valid. (4) The UFS device or driver must subsequently be detached - freeing the hba memory - before the trace file is read, creating the use-after-free condition. Systems without UFS hardware, systems with tracing access restricted to root, or systems running patched kernel versions (6.18.40+, 7.1.5+, 7.2+) are not exploitable. The timing dependency between device detachment and trace read limits reliable, repeatable exploitation.

The official CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as High severity with low complexity, which may overstate exploitability. The core race condition - requiring that the hba object be freed precisely while userspace is reading the trace file - introduces a timing dependency that AC:L does not reflect. EPSS of 0.17% at the 6th percentile independently confirms low exploitation probability. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit has been identified. Real-world risk is further bounded by requiring: a UFS-equipped Linux host, local access with tracing subsystem permissions, and successful triggering of the use-after-free timing window. The C:H/I:H classification assumes full kernel memory access from a UAF primitive, which is theoretically possible but requires additional exploitation work beyond the initial dereference. This is primarily a kernel stability and availability risk for UFS-bearing systems, not an easily weaponizable privilege escalation path.

A local user with permissions to read /sys/kernel/tracing/trace triggers a UFS tracepoint (e.g., by initiating a UFS I/O operation), then causes the UFS host bus adapter to be unbound or removed (physical removal or driver unbind) before reading the trace file. When the trace output is rendered, the kernel dereferences the now-freed hba pointer to obtain the device name, accessing freed memory and crashing the kernel or, in an optimistic attacker scenario, influencing kernel execution via heap manipulation. No public proof-of-concept exploit has been identified at time of analysis.