CVE-2026-80677

In the Linux kernel, the following vulnerability has been resolved:

driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

dev_has_sync_state() reads dev->driver twice without holding

device_lock() -- once for the NULL check and once to dereference

->sync_state. Some callers only hold device_links_write_lock, which

doesn't prevent a concurrent unbind from clearing dev->driver via

device_unbind_cleanup().

Fix it by reading dev->driver exactly once with READ_ONCE(), pairing

with the WRITE_ONCE() in device_set_driver().