VulnerabilityPublished 24 Sep 2026Updated 30 Oct 2026

CVE-2026-97479: Linux kernel · driver core: Avoid warning when removing a device while its supplier is unbinding

Source GCVE Database

Compare

Authoritative record:CVE-2026-97479· Low

Not known to be exploited · fixed in da22e4bce2a8cbed32dcda407b7d06cb5feec8e3 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 17:52 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in da22e4bce2a8cbed32dcda407b7d06cb5feec8e3, d5eb39d6178ca88db706c7b82dcd19a77f30aa9e, 73ea4ec0ec46d12558a61842b474e7dd63538edc +4

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-92xh-vv6q-4wqq

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.6.19 <5.7 >=5.7.3 <5.8	Fixed in da22e4bce2a8cbed32dcda407b7d06cb5feec8e3 d5eb39d6178ca88db706c7b82dcd19a77f30aa9e 73ea4ec0ec46d12558a61842b474e7dd63538edc 36d74f17e03f7e60e1b08fbe16cfad6e69cc3aa9 5.8 5.7 3d13785eabc3871bde179f3f17a2b2bef064864a
LinuxLinux	Affected =5.8	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel to avoid the warning when the supplier's link status is DL_DEV_UNBINDING during device removal. Users should update to the fixed kernel version once available to eliminate these warnings. No other mitigation actions are required.

Description

CVE-2026-97479 addresses a warning in the Linux kernel driver core that occurs during device removal when a device's supplier is in the process of unbinding. The warning arises due to the supplier's link status being set to DL_DEV_UNBINDING rather than DL_DEV_DRIVER_BOUND, which is a legitimate state during a complex device removal sequence involving multiple dependent devices. The fix prevents this warning from appearing, supporting proper removal sequences without unnecessary alerts.

Impact

The issue causes a warning message during device removal in the Linux kernel, which may confuse developers or system administrators monitoring kernel logs. There is no indication of security impact such as privilege escalation, denial of service, or code execution. The fix improves kernel stability and clarity by preventing unnecessary warnings during valid device removal sequences.

Summary

This vulnerability involves a warning triggered in the Linux kernel driver core when removing a device while its supplier device is simultaneously unbinding. The warning occurs because the supplier's link status is DL_DEV_UNBINDING instead of DL_DEV_DRIVER_BOUND, which is expected during the removal of interconnected devices such as i2c, pinctrl, OIC (interrupt controller), and PCI devices in a specific order. The patch avoids this warning by recognizing DL_DEV_UNBINDING as a valid state during device removal, thus preventing misleading warnings during legitimate unbinding sequences.

References

Community reviews

Loading reviews…