# CVE-2026-80563: linux: In the Linux kernel, the following vulnerability has been resolved:  gpio: sloppy-logic-analyzer: fix use-after-free...

CVE-2026-80563 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-80563, released August 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-80563
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 26, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind  The "trigger" debugfs file has a hand-rolled ->write handler (trigger_write()) that dereferences the per-device gpio_la_poll_priv. The file is created with debugfs_create_file_unsafe(), and the handler never takes a debugfs reference. Nothing keeps the object alive while the handler runs.  priv is allocated with devm_kzalloc(). devres frees it when the platform device is unbound. debugfs_create_file_unsafe() installs no full_proxy wrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not wait for an in-flight trigger_write(). The blob_lock taken there does not help, because trigger_write() never takes it. A write that races an unbind therefore writes into freed memory:    trigger_write()                  gpio_la_poll_remove()     priv = m->private     buf = memdup_user()  [may sleep]                                      mutex_lock(&priv->blob_lock)                                      debugfs_remove_recursive()  [no wait]                                      mutex_unlock(&priv->blob_lock)                                    (remove returns; devres frees priv)     priv->trig_data = buf   <-- use-after-free write     priv->trig_len  = count  The race is reachable by root via /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.  Create "trigger" with debugfs_create_file() instead. Its full_proxy wrapper makes debugfs_remove_recursive() drain any in-flight ->write before it returns.  The use-after-free is confirmed under KASAN with a minimal reproducer of the same debugfs_create_file_unsafe() plus devm_kzalloc() pattern (available on request); it produces a slab-use-after-free write in the handler.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.105-1 | [DEBIAN-CVE-2026-80563](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80563.md) | Aug 27, 2026 |
| Linux | linux Debian 14 | 7.1.10-1 | [DEBIAN-CVE-2026-80563](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80563.md) | Aug 27, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.107-1~deb12u1 | [DEBIAN-CVE-2026-80563](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80563.md) | Aug 27, 2026 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.