CVE-2026-80572

Input: byd - synchronize timer deletion before freeing private data

State: Published
Severity: 7.8 High
Published: Aug 26, 2026
Updated: Oct 30, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: byd - synchronize timer deletion before freeing private data

byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait for a running byd_clear_touch() callback, which dereferences the private data and its psmouse pointer. A callback racing with disconnect can therefore access the private data after it has been freed. The timer can also still be re-armed by byd_process_byte() while the disconnect is in progress.

Use timer_shutdown_sync() before freeing the private data: it waits for a running callback and turns any later re-arm attempt into a no-op.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2d5f5611dd0de52e9a52b56391a7049a52184e72 to before fe2785d5513b3254368a1f0831515fc59ab0d40dAffected 2d5f5611dd0de52e9a52b56391a7049a52184e72 to before b4d74810aad9b29c313b4d7880c84aceb5abe488Affected 2d5f5611dd0de52e9a52b56391a7049a52184e72 to before 84b205297fa15f97510342221d8c9a0119711478Affected 2d5f5611dd0de52e9a52b56391a7049a52184e72 to before 28d984a66b9e14be74986167b6ad40b5e0daf19aAffected 2d5f5611dd0de52e9a52b56391a7049a52184e72 to before ee944a706a18322b4a2599eebe8040a2994e928fAffected 2d5f5611dd0de52e9a52b56391a7049a52184e72 to before 8dbfd8e32a13e116790780ed0be82b5a05eb9916Affected 2d5f5611dd0de52e9a52b56391a7049a52184e72 to before 2e509ef60ee41a2da0deb062c262bb530143fb37Affected 2d5f5611dd0de52e9a52b56391a7049a52184e72 to before c83e79c0842ed29860648bcce5022ef0ba5001c6Affected
LinuxLinux	4.6Affected before 4.6Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.185 through 6.1.Not affected 6.6.154 through 6.6.Not affected 6.12.106 through 6.12.Not affected 6.18.46 through 6.18.Not affected 7.1.10 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

2d5f5611dd0de52e9a52b56391a7049a52184e72 to before fe2785d5513b3254368a1f0831515fc59ab0d40dAffected
2d5f5611dd0de52e9a52b56391a7049a52184e72 to before b4d74810aad9b29c313b4d7880c84aceb5abe488Affected
2d5f5611dd0de52e9a52b56391a7049a52184e72 to before 84b205297fa15f97510342221d8c9a0119711478Affected
2d5f5611dd0de52e9a52b56391a7049a52184e72 to before 28d984a66b9e14be74986167b6ad40b5e0daf19aAffected
2d5f5611dd0de52e9a52b56391a7049a52184e72 to before ee944a706a18322b4a2599eebe8040a2994e928fAffected
2d5f5611dd0de52e9a52b56391a7049a52184e72 to before 8dbfd8e32a13e116790780ed0be82b5a05eb9916Affected
2d5f5611dd0de52e9a52b56391a7049a52184e72 to before 2e509ef60ee41a2da0deb062c262bb530143fb37Affected
2d5f5611dd0de52e9a52b56391a7049a52184e72 to before c83e79c0842ed29860648bcce5022ef0ba5001c6Affected

LinuxLinux

4.6Affected
before 4.6Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.185 through 6.1.*Not affected
6.6.154 through 6.6.*Not affected
6.12.106 through 6.12.*Not affected
6.18.46 through 6.18.*Not affected
7.1.10 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.