{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  hwmon: (occ) unregister sysfs devices outside occ lock  occ_active(false) and occ_shutdown() unregister sysfs-backed devices while occ-\u003elock is held.  hwmon_device_unregister() and sysfs_remove_group() can wait for active sysfs callbacks to drain, and those callbacks can enter the OCC update path and try to take occ-\u003elock again.  That gives the unregister paths the lock ordering occ-\u003elock -\u003e sysfs callback drain, while a callback has the opposite edge sysfs callback -\u003e occ-\u003elock.  This issue was found by our static analysis tool and then manually reviewed against the current tree.  The grounded PoC kept the real unregister and callback carrier:    occ_shutdown()   hwmon_device_unregister()   occ_show_temp_1()   occ_update_response()  Lockdep reported the circular dependency with occ_shutdown() already holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs side:    WARNING: possible circular locking dependency detected   ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv]   ... (\u0026test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv]   occ_update_response.isra.0+0xb/0x20 [vuln_msv]   occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv]   *** DEADLOCK ***  Serialize hwmon registration and removal with a separate hwmon_lock. Under that lock, detach occ-\u003ehwmon and update occ-\u003eactive while occ-\u003elock is held so concurrent OCC state changes still see a stable state, then drop occ-\u003elock before calling hwmon_device_unregister().  Remove the driver sysfs group before taking occ-\u003elock in occ_shutdown(), so draining the driver attributes cannot wait while the OCC mutex is held.  Also make OCC update callbacks return -ENODEV after deactivation, so callbacks that already passed sysfs active protection do not poll the hardware after teardown has detached the hwmon device.",
  "id": "DEBIAN-CVE-2026-80660",
  "modified": "2026-09-14T16:47:36.157403910Z",
  "published": "2026-08-28T08:16:51.160Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80660"
    }
  ],
  "upstream": [
    "CVE-2026-80660"
  ]
}