HIGH Introduced in 2.6.23
ata sl82c105 BridgeRevision UAF
CVE-2026-80732
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge revision use-after-free pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci_dev_put(). The bridge may therefore be freed before its revision is read. Read the revision before dropping the reference.
02KernelScan AI Analysis
Risk summary
A use-after-free in the Winbond SL82C105 PATA host bridge driver allows a privileged local attacker to trigger a kernel panic or memory corruption by reading a freed PCI device's revision field. The bug requires specific hardware and root-level privileges to trigger.
Vulnerability analysis
The SL82C105 PATA driver looks up a companion PCI bridge device and reads its cached revision field, but drops the reference count on that device before accessing the revision. If the bridge is removed between the reference drop and the field read, the driver dereferences freed memory. The fix reads the revision into a local variable before releasing the reference, ensuring the value is captured while the device is still pinned. This code path is only reached on systems with the specific Winbond SL82C105 PATA controller present, and triggering it requires privileged local access to the ATA subsystem.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.23 | 5.10.265 | 1268ca9418e2 |
| 5.15 | 2.6.23 | 5.15.216 | a626dfca9604 |
| 6.1 | 2.6.23 | 6.1.183 | 5ef87b1b4656 |
| 6.12 | 2.6.23 | 6.12.104 | dc711fb137b3 |
| 6.18 | 2.6.23 | 6.18.45 | a837deeaa37c |
| 6.6 | 2.6.23 | 6.6.152 | fa0dca89b4fb |
| 7.1 | 2.6.23 | 7.1.9 | 56fd78c8c820 |
| mainline | 2.6.23 | 7.2 | 7700a31039cd |
| cip/4.19 | 2.6.23 | 4.19.325-cip136 | 488ca042d3f5 |
| cip/4.19-rt | 2.6.23 | 4.19.325-cip136-rt50 | 488ca042d3f5 |
| cip/4.4 | 2.6.23 | 4.4.302-cip115 | 3f1acfe2025f |
| cip/4.4-rt | 2.6.23 | 4.4.302-cip115-rt63 | 3f1acfe2025f |
| cip/5.10 | 2.6.23 | 5.10.268-cip77 | 1268ca9418e2 |
| cip/5.10-rt | 2.6.23 | 5.10.268-cip77-rt34 | 1268ca9418e2 |
| cip/6.1 | 2.6.23 | 6.1.187-cip60 | 5ef87b1b4656 |
| cip/6.1-rt | 2.6.23 | 6.1.189-cip61-rt32 | 5ef87b1b4656 |
| cip/6.12 | 2.6.23 | 6.12.104-cip30 | dc711fb137b3 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |
| cip/4.4 | Fixed in 4.4.302-cip115 |
| cip/4.4-rt | Fixed in 4.4.302-cip115-rt63 |