In the Linux kernel, the following vulnerability has been resolved: hwmon: (occ) unregister sysfs devices outside occ lock occ_active(false) and occ_shutdown() unregister sysfs-backed devices while occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can wait for active sysfs callbacks to drain, and those callbacks can enter the OCC update path and try to take occ->lock again. That gives the unregister paths the lock ordering occ->lock -> sysfs callback drain, while a callback has the opposite edge sysfs callback -> occ->lock. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the real unregister and callback carrier: occ_shutdown() hwmon_device_unregister() occ_show_temp_1() occ_update_response() Lockdep reported the circular dependency with occ_shutdown() already holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs side: WARNING: possible circular locking dependency detected ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv] ... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv] occ_update_response.isra.0+0xb/0x20 [vuln_msv] occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv] *** DEADLOCK *** Serialize hwmon registration and removal with a separate hwmon_lock. Under that lock, detach occ->hwmon and update occ->active while occ->lock is held so concurrent OCC state changes still see a stable state, then drop occ->lock before calling hwmon_device_unregister(). Remove the driver sysfs group before taking occ->lock in occ_shutdown(), so draining the driver attributes cannot wait while the OCC mutex is held. Also make OCC update callbacks return -ENODEV after deactivation, so callbacks that already passed sysfs active protection do not poll the hardware after teardown has detached the hwmon device.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - hwmon: (occ) unregister sysfs devices outside occ lock occ_active(false) and occ_shutdown() unregister     sysfs-backed devices while occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can wait     for active sysfs callbacks to drain, and those callbacks can enter the OCC update path and try to take     occ->lock again. That gives the unregister paths the lock ordering occ->lock -> sysfs callback drain,     while a callback has the opposite edge sysfs callback -> occ->lock. This issue was found by our static     analysis tool and then manually reviewed against the current tree. The grounded PoC kept the real     unregister and callback carrier: occ_shutdown() hwmon_device_unregister() occ_show_temp_1()     occ_update_response() Lockdep reported the circular dependency with occ_shutdown() already holding the OCC     mutex and hwmon_device_unregister() waiting on the sysfs side: WARNING: possible circular locking     dependency detected ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv] ...
    (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv] occ_update_response.isra.0+0xb/0x20     [vuln_msv] occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv] *** DEADLOCK *** Serialize hwmon     registration and removal with a separate hwmon_lock. Under that lock, detach occ->hwmon and update     occ->active while occ->lock is held so concurrent OCC state changes still see a stable state, then drop     occ->lock before calling hwmon_device_unregister(). Remove the driver sysfs group before taking occ->lock     in occ_shutdown(), so draining the driver attributes cannot wait while the OCC mutex is held. Also make     OCC update callbacks return -ENODEV after deactivation, so callbacks that already passed sysfs active     protection do not poll the hardware after teardown has detached the hwmon device. (CVE-2026-80660)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365525	Ubuntu 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8918-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365522	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	Local	medium
341958	Linux Distros Unpatched Vulnerability : CVE-2026-80660	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-80660

high

Tenable Plugins

medium

medium

medium

medium

medium

medium