{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-80975 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-80975 is a high-severity use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-80975 and fix it if it is affected.\n\nWhat it is: CVE-2026-80975 is a high-severity use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-80975 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-80975/ (Markdown: https://insights.sbomify.com/CVE-2026-80975/index.md)","id":"CVE-2026-80975","markdown":"https://insights.sbomify.com/CVE-2026-80975/index.md","name":"CVE-2026-80975","record":{"aliases":["BELL-CVE-2026-80975","DEBIAN-CVE-2026-80975","GHSA-r5c2-6w2m-2m2q","UBUNTU-CVE-2026-80975"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A use-after-free vulnerability in the QNAP MCU kernel driver allows attackers to corrupt stack memory via late replies, potentially leading to code execution or privilege escalation.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: qnap-mcu: keep the reply buffer alive past a command timeout\n\nqnap_mcu_exec() publishes an on-stack buffer to the receive path:\n\n\tunsigned char rx[QNAP_MCU_RX_BUFFER_SIZE];\n\t...\n\treply-\u003edata = rx;\n\treply-\u003elength = length;\n\nand qnap_mcu_receive_buf() writes into it from the serdev receive path,\nwhich runs out of flush_to_ldisc() and is not serialized against\nqnap_mcu_exec() at all. bus_lock cannot cover it, because qnap_mcu_exec()\nholds that mutex across wait_for_completion_timeout().\n\nOn a timeout qnap_mcu_exec() returns with reply-\u003edata still pointing at\nits own frame. A reply that arrives late, or an unsolicited message from\nthe MCU, is then written into a stack frame that has been left, corrupting\nwhatever runs next on that stack. The same applies when qnap_mcu_write()\nfails, since that path returns without touching the reply state either.\n\nMove the receive buffer into struct qnap_mcu. It is 37 bytes and the\nstructure is devm_kzalloc()ed, so it lives as long as the driver, and a\nlate write lands in memory that is still valid and is reinitialized by the\nnext command. bus_lock keeps commands from sharing it.\n\nThis deliberately does not clear reply-\u003edata or reply-\u003elength on the\ntimeout path. Doing so races with qnap_mcu_receive_buf(), which reads both\nafter its\n\n\tif (!reply-\u003elength)\n\t\treturn size;\n\ncheck: clearing reply-\u003edata gives a NULL dereference, and clearing\nreply-\u003elength alone removes the reply-\u003ereceived == reply-\u003elength exit\ncondition, so the copy loop runs until the uart chunk is consumed and\noverruns the buffer. Leaving both set keeps the write bounded by\nreply-\u003elength, which qnap_mcu_exec() has already checked against\nsizeof(mcu-\u003erx).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"mfd: qnap-mcu: keep the reply buffer alive past a command timeout","id":"CVE-2026-80975","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"seg6: reset IP6CB after IPv6 decapsulation","id":"CVE-2026-80976"},"packages":[],"prev":{"headline":"mfd: sm501: Fix potential memory leaks during remove","id":"CVE-2026-80974"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the QNAP MCU kernel driver allows attackers to corrupt stack memory via late replies, potentially leading to code execution or privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-80975/"}