CVE-2026-80622

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

char: tlclk: fix use-after-free in tlclk_cleanup()

This patch improves the module cleanup process in the tlclk driver to

prevent potential use-after-free and race conditions.

Currently, the file_operations structure does not specify the .owner

field, which could allow the module to be unloaded while user-space

processes are still interacting with the device. Additionally, the

tlclk_cleanup() function frees the alarm_events memory before ensuring

that blocked processes in the waitqueue are fully awakened and that the

switchover_timer has completed.

To address these cases, this patch:

- Sets '.owner = THIS_MODULE' in tlclk_fops to safely defer module

unloading while the device is in use.

- Updates tlclk_cleanup() to explicitly wake up all blocked readers

(wake_up_all), properly release hardware I/O regions, and safely

delete the timer (timer_delete_sync) prior to freeing memory.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References