In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge revision use-after-free pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci_dev_put(). The bridge may therefore be freed before its revision is read. Read the revision before dropping the reference.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80732 is a use-after-free vulnerability in the Linux kernel's PATA SL82C105 ATA driver that occurs when reading a PCI bridge's revision field after the device reference has been released. The vulnerability stems from a code refactoring that moved a direct revision field access to occur after pci_dev_put(), allowing the bridge device to be freed from memory while still being accessed. This affects systems using the sl82c105 ATA controller driver and could lead to kernel crashes, information disclosure, or potential code execution. Organizations running affected Linux kernel versions on hardware with this specific controller face risk of system instability and potential exploitation by local attackers with hardware access or kernel-level privileges.
While Casky.ai's 754 mapped security skills currently show zero direct matches for this specific vulnerability pattern, the underlying issue represents a common kernel exploitation technique: use-after-free memory corruption. In a real-world detection scenario, Casky's Claude AI-powered analysis would identify attack patterns aligned with CWE-416 (Use After Free) techniques, examining kernel memory access violations, reference counting failures, and object lifecycle management flaws. A practitioner using Casky would see findings highlighting improper resource management, dangling pointer dereferences, and the sequence of operations that enable the vulnerability—particularly the critical ordering issue where a cached field is accessed after its containing object's reference count reaches zero.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80732. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation