KernelScan.io

HIGH Introduced in 2.6.15

char tlclk Cleanup UAF

CVE-2026-80622

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI6.9MEDIUM

01

In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk_cleanup() This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the file_operations structure does not specify the .owner field, which could allow the module to be unloaded while user-space processes are still interacting with the device. Additionally, the tlclk_cleanup() function frees the alarm_events memory before ensuring that blocked processes in the waitqueue are fully awakened and that the switchover_timer has completed. To address these cases, this patch: - Sets '.owner = THIS_MODULE' in tlclk_fops to safely defer module unloading while the device is in use. - Updates tlclk_cleanup() to explicitly wake up all blocked readers (wake_up_all), properly release hardware I/O regions, and safely delete the timer (timer_delete_sync) prior to freeing memory.

02

Engine v0.6.0

Risk summary

A local user with access to the tlclk device can trigger a use-after-free during module unload, potentially leading to privilege escalation or system crash. The bug requires specific hardware (MPCBL0010 ATCA blade) and winning a race window during module cleanup.

Affecteddrivers/char/tlclk.c (tlclk driver)

Vulnerability analysis

The driver frees memory during cleanup while user-space processes may still be blocked waiting for events and while a background timer is still running. If the module is unloaded while a process has the device open, this leads to a use-after-free. The fix prevents unloading while the device is in use, wakes any blocked readers, and waits for the timer to complete before releasing memory. A local user who can open the telecom clock device can reach the bug, but only on systems with the specific ATCA hardware and this driver loaded.

03

BranchIntroducedFixed inPatch commit
5.102.6.155.10.26109d8d2a46a9e
5.152.6.155.15.21296902299a22d
6.12.6.156.1.178166dd1d5265e
6.122.6.156.12.97c3f0cd76561a
6.182.6.156.18.403d5e4cc0d9dc
6.62.6.156.6.145764723bd67a6
7.12.6.157.1.542223445607a
mainline2.6.157.2bbf003b7794d
cip/4.192.6.154.19.325-cip136f6fdbaf57288
cip/4.19-rt2.6.154.19.325-cip136-rt50f6fdbaf57288
cip/4.42.6.154.4.302-cip1159c6ee713fef5
cip/4.4-rt2.6.154.4.302-cip115-rt639c6ee713fef5
cip/5.102.6.155.10.263-cip7609d8d2a46a9e
cip/5.10-rt2.6.155.10.268-cip77-rt3409d8d2a46a9e
cip/6.12.6.156.1.182-cip59166dd1d5265e
cip/6.1-rt2.6.156.1.182-cip59-rt31166dd1d5265e
cip/6.122.6.156.12.101-cip29c3f0cd76561a

04

State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.

CIP treeState
cip/6.12Fixed in 6.12.101-cip29
cip/6.1Fixed in 6.1.182-cip59
cip/6.1-rtFixed in 6.1.182-cip59-rt31
cip/5.10Fixed in 5.10.263-cip76
cip/5.10-rtFixed in 5.10.268-cip77-rt34
cip/4.19Fixed in 4.19.325-cip136
cip/4.19-rtFixed in 4.19.325-cip136-rt50
cip/4.4Fixed in 4.4.302-cip115
cip/4.4-rtFixed in 4.4.302-cip115-rt63