{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-80562 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-80562 is a vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-80562 and fix it if it is affected.\n\nWhat it is: CVE-2026-80562 is a vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-80562 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-80562/ (Markdown: https://insights.sbomify.com/CVE-2026-80562/index.md)","id":"CVE-2026-80562","markdown":"https://insights.sbomify.com/CVE-2026-80562/index.md","name":"CVE-2026-80562","record":{"aliases":["AZL-97731","BELL-CVE-2026-80562","DEBIAN-CVE-2026-80562","GHSA-rxfg-5fgw-mwq5","UBUNTU-CVE-2026-80562"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A locking bug in the Linux kernel gpio: ml-ioh driver causes a deadlock on PREEMPT_RT systems, leading to denial of service.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: ml-ioh: use raw_spinlock_t for the register lock\n\nioh_irq_type() is registered as the irq_chip .irq_set_type callback and\ntakes chip-\u003espinlock with spin_lock_irqsave().  This callback is reached\nfrom __setup_irq() -\u003e __irq_set_trigger() -\u003e chip-\u003eirq_set_type() while\nthe caller holds desc-\u003elock, a raw_spinlock_t, with hardirqs disabled.\nThat context is not sleepable, but on PREEMPT_RT a regular spinlock_t is\nan rtmutex-backed sleeping lock, so acquiring it there is invalid.\nioh_irq_enable() and ioh_irq_disable() take the same lock from the\n.irq_enable/.irq_disable callbacks, which are likewise invoked with\ndesc-\u003elock held.\n\nConvert the register lock to raw_spinlock_t.  The same lock also\nserializes the GPIO direction/value callbacks and the suspend/resume\nregister save/restore, and those critical sections only perform short\nsequences of MMIO register accesses (ioread32()/iowrite32()); the\n.irq_set_type callback additionally emits a dev_warn() on an unsupported\ntype.  None of these are sleepable operations, so keeping this register\nlock non-sleeping is appropriate for the irqchip callbacks and does not\nchange the GPIO-side locking contract.\n\nThis is the same fix as commit a02b8950d619 (\"gpio: pch: use\nraw_spinlock_t for the register lock\"); this driver shares the same\nstructure as gpio-pch.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"gpio: ml-ioh: use raw_spinlock_t for the register lock","id":"CVE-2026-80562","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind","id":"CVE-2026-80563"},"packages":[],"prev":{"headline":"libceph: fix multiple unsafe decodes in decode_locker()","id":"CVE-2026-80561"},"products":["Linux"],"published":"2026-08-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-27","vendors":["Linux"]},"summary":"A locking bug in the Linux kernel gpio: ml-ioh driver causes a deadlock on PREEMPT_RT systems, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-80562/"}