CVE-2026-80659: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-7xh8-9fpc-p64f
Share
Published
Advisory Summary

CVE-2026-80659 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-80659 at a Glance

CVE Identifier CVE-2026-80659
GHSA Identifier GHSA-7xh8-9fpc-p64f
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-80659

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-80659, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmd_mutex is unlocked vub300_cmndwork_thread() holds cmd_mutex while it sends a command and waits for the command response. If the response wait times out, __vub300_command_response() kills the command URBs and then synchronously resets the USB device through usb_reset_device(). That reset path re-enters the driver through vub300_pre_reset(), which also takes cmd_mutex. The worker therefore tries to acquire the same mutex recursively while it is still holding it from the command path. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the real worker and timeout/reset carrier: vub300_cmndwork_thread() __vub300_command_response() usb_lock_device_for_reset() usb_reset_device() vub300_pre_reset() Lockdep reported the same-task recursive acquisition on cmd_mutex: WARNING: possible recursive locking detected ... (&test_vub300.cmd_mutex) ... at: usb_reset_device... [vuln_msv] ... (&test_vub300.cmd_mutex) ... at: vub300_cmndwork_thread+0x12/0x20 [vuln_msv] Workqueue: vub300_cmd_wq vub300_cmndwork_thread [vuln_msv] *** DEADLOCK *** Return a flag from __vub300_command_response() when the timeout path needs a device reset, then perform the reset after vub300_cmndwork_thread() has cleared the in-flight command state and dropped cmd_mutex. The reset is still attempted before mmc_request_done(), preserving the existing request completion ordering while avoiding the recursive lock.

References

NVD — CVE-2026-80659 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80659
git.kernel.org/stable/c/2e6b9a3942... WEB
https://git.kernel.org/stable/c/2e6b9a394206c76dd417c991312f349435ef35e6
git.kernel.org/stable/c/7ee7a77ec2... WEB
https://git.kernel.org/stable/c/7ee7a77ec2f446109ab52cc80ace7acc22ab6211
git.kernel.org/stable/c/8344611477... WEB
https://git.kernel.org/stable/c/8344611477c9241f45f20981990780fc5f0996f8
git.kernel.org/stable/c/8672b8bdbd... WEB
https://git.kernel.org/stable/c/8672b8bdbd2063b3fcbd75f729e4706fcdad2257
git.kernel.org/stable/c/9f5e04235a... WEB
https://git.kernel.org/stable/c/9f5e04235a0b59e6e30af9f45511addf2604d757
git.kernel.org/stable/c/bf9848a22a... WEB
https://git.kernel.org/stable/c/bf9848a22a8e50d39d5e8d871581f0a8110f16b3
git.kernel.org/stable/c/c2e1d33929... WEB
https://git.kernel.org/stable/c/c2e1d33929565fa14c48d8a5a45edc3ebfc941b2
git.kernel.org/stable/c/ee5fb641c4... WEB
https://git.kernel.org/stable/c/ee5fb641c4ccac8406c668d3e947eb20ce44f233

Frequently Asked Questions

What is CVE-2026-80659?
CVE-2026-80659 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-80659?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-80659?
CVE-2026-80659 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-80659?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7xh8-9fpc-p64f",
  "modified" : "2026-08-28T09:31:48Z",
  "published" : "2026-08-28T09:31:48Z",
  "aliases" : [ "CVE-2026-80659" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: defer reset until cmd_mutex is unlocked\n\nvub300_cmndwork_thread() holds cmd_mutex while it sends a command and\nwaits for the command response.  If the response wait times out,\n__vub300_command_response() kills the command URBs and then synchronously\nresets the USB device through usb_reset_device().\n\nThat reset path re-enters the driver through vub300_pre_reset(), which\nalso takes cmd_mutex.  The worker therefore tries to acquire the same\nmutex recursively while it is still holding it from the command path.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the real worker and timeout/reset carrier:\n\n  vub300_cmndwork_thread()\n  __vub300_command_response()\n  usb_lock_device_for_reset()\n  usb_reset_device()\n  vub300_pre_reset()\n\nLockdep reported the same-task recursive acquisition on cmd_mutex:\n\n  WARNING: possible recursive locking detected\n  ... (&test_vub300.cmd_mutex) ... at: usb_reset_device... [vuln_msv]\n  ... (&test_vub300.cmd_mutex) ... at: vub300_cmndwork_thread+0x12/0x20 [vuln_msv]\n  Workqueue: vub300_cmd_wq vub300_cmndwork_thread [vuln_msv]\n  *** DEADLOCK ***\n\nReturn a flag from __vub300_command_response() when the timeout path needs\na device reset, then perform the reset after vub300_cmndwork_thread() has\ncleared the in-flight command state and dropped cmd_mutex.  The reset is\nstill attempted before mmc_request_done(), preserving the existing request\ncompletion ordering while avoiding the recursive lock.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80659"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2e6b9a394206c76dd417c991312f349435ef35e6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7ee7a77ec2f446109ab52cc80ace7acc22ab6211"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8344611477c9241f45f20981990780fc5f0996f8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8672b8bdbd2063b3fcbd75f729e4706fcdad2257"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9f5e04235a0b59e6e30af9f45511addf2604d757"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bf9848a22a8e50d39d5e8d871581f0a8110f16b3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c2e1d33929565fa14c48d8a5a45edc3ebfc941b2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ee5fb641c4ccac8406c668d3e947eb20ce44f233"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-28T08:16:51Z"
  }
}