VulnerabilityPublished 28 Aug 2026Updated 21 Oct 2026

CVE-2026-80643: Linux kernel · EDAC/igen6: Fix call trace due to missing release()

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fa9560b6d3f665eddf7a625adfc9af8c6980c3f5 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fa9560b6d3f665eddf7a625adfc9af8c6980c3f5, ab1f9d466c7d83ab0d2a529e07984e53b5960dcd, a341302c5126ef96bb45286224d67ef60a24281e +2

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 10590a9d4f23e0a519730d79d39331df60ad2079, < fa9560b6d3f665eddf7a625adfc9af8c6980c3f5	Fixed in fa9560b6d3f665eddf7a625adfc9af8c6980c3f5
LinuxLinux	Affected ≥ 10590a9d4f23e0a519730d79d39331df60ad2079, < ab1f9d466c7d83ab0d2a529e07984e53b5960dcd	Fixed in ab1f9d466c7d83ab0d2a529e07984e53b5960dcd
LinuxLinux	Affected ≥ 10590a9d4f23e0a519730d79d39331df60ad2079, < a341302c5126ef96bb45286224d67ef60a24281e	Fixed in a341302c5126ef96bb45286224d67ef60a24281e
LinuxLinux	Affected ≥ 10590a9d4f23e0a519730d79d39331df60ad2079, < 449ba210e6bee9ef6e69c6ab58198ffa5aa479ae	Fixed in 449ba210e6bee9ef6e69c6ab58198ffa5aa479ae
LinuxLinux	Affected ≥ 10590a9d4f23e0a519730d79d39331df60ad2079, < 9a84ced0243c74aa431ec287555054c69e6167d1	Fixed in 9a84ced0243c74aa431ec287555054c69e6167d1
LinuxLinux	Affected =5.11	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: EDAC/igen6: Fix call trace due to missing release() When unloading the igen6_edac driver, there is a call trace: Device '(null)' does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst. WARNING: drivers/base/core.c:2567 at device_release+0x84/0x90, CPU#5: rmmod/127209 ... RIP: 0010:device_release+0x84/0x90 Call Trace: <TASK> kobject_put+0x8c/0x220 put_device+0x17/0x30 igen6_unregister_mcis+0xa2/0xe0 [igen6_edac] igen6_remove+0x82/0xb0 [igen6_edac] ... Fix the call trace by providing empty release() functions for the memory controller devices.

References

Community reviews

Loading reviews…