HIGH Introduced in 2.6.15
char tlclk Cleanup UAF
CVE-2026-80622
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk_cleanup() This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the file_operations structure does not specify the .owner field, which could allow the module to be unloaded while user-space processes are still interacting with the device. Additionally, the tlclk_cleanup() function frees the alarm_events memory before ensuring that blocked processes in the waitqueue are fully awakened and that the switchover_timer has completed. To address these cases, this patch: - Sets '.owner = THIS_MODULE' in tlclk_fops to safely defer module unloading while the device is in use. - Updates tlclk_cleanup() to explicitly wake up all blocked readers (wake_up_all), properly release hardware I/O regions, and safely delete the timer (timer_delete_sync) prior to freeing memory.
02KernelScan AI Analysis
Risk summary
A local user with access to the tlclk device can trigger a use-after-free during module unload, potentially leading to privilege escalation or system crash. The bug requires specific hardware (MPCBL0010 ATCA blade) and winning a race window during module cleanup.
Vulnerability analysis
The driver frees memory during cleanup while user-space processes may still be blocked waiting for events and while a background timer is still running. If the module is unloaded while a process has the device open, this leads to a use-after-free. The fix prevents unloading while the device is in use, wakes any blocked readers, and waits for the timer to complete before releasing memory. A local user who can open the telecom clock device can reach the bug, but only on systems with the specific ATCA hardware and this driver loaded.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.15 | 5.10.261 | 09d8d2a46a9e |
| 5.15 | 2.6.15 | 5.15.212 | 96902299a22d |
| 6.1 | 2.6.15 | 6.1.178 | 166dd1d5265e |
| 6.6 | 2.6.15 | 6.6.145 | 764723bd67a6 |
| 6.18 | 2.6.15 | 6.18.40 | 3d5e4cc0d9dc |
| 7.1 | 2.6.15 | 7.1.5 | 42223445607a |
| mainline | 2.6.15 | 7.2 | bbf003b7794d |
| 6.12 | 2.6.15 | 6.12.97 | c3f0cd76561a |
| cip/4.19 | 2.6.15 | 4.19.325-cip136 | f6fdbaf57288 |
| cip/4.19-rt | 2.6.15 | 4.19.325-cip136-rt50 | f6fdbaf57288 |
| cip/4.4 | 2.6.15 | 4.4.302-cip115 | 9c6ee713fef5 |
| cip/4.4-rt | 2.6.15 | 4.4.302-cip115-rt63 | 9c6ee713fef5 |
| cip/5.10 | 2.6.15 | 5.10.263-cip76 | 09d8d2a46a9e |
| cip/5.10-rt | 2.6.15 | 5.10.268-cip77-rt34 | 09d8d2a46a9e |
| cip/6.1 | 2.6.15 | 6.1.182-cip59 | 166dd1d5265e |
| cip/6.1-rt | 2.6.15 | 6.1.182-cip59-rt31 | 166dd1d5265e |
| cip/6.12 | 2.6.15 | 6.12.101-cip29 | c3f0cd76561a |