HIGH Introduced in 4.6
input byd Disconnect UAF
CVE-2026-80572
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait for a running byd_clear_touch() callback, which dereferences the private data and its psmouse pointer. A callback racing with disconnect can therefore access the private data after it has been freed. The timer can also still be re-armed by byd_process_byte() while the disconnect is in progress. Use timer_shutdown_sync() before freeing the private data: it waits for a running callback and turns any later re-arm attempt into a no-op.
02KernelScan AI Analysis
Risk summary
A race condition in the BYD touchpad driver's disconnect path allows a timer callback to access freed private data. A local attacker who can trigger device disconnect while the timer is active could exploit this for kernel memory corruption, leading to privilege escalation or denial of service.
Vulnerability analysis
The BYD touchpad driver's disconnect handler deletes a timer and immediately frees the driver's private data, but the deletion does not wait for a callback that may already be running. That callback dereferences the private data and its parent pointer, so a timer firing concurrently with device removal can access memory after it has been freed. The timer can also be re-armed by incoming touchpad data while disconnect is in progress, widening the race window. The fix replaces the deletion call with a synchronous shutdown that waits for any running callback to finish and prevents the timer from being re-armed afterward. The vulnerable code is reached through the PS/2 mouse driver when a BYD touchpad is present, requiring local access and the ability to trigger device removal or input activity.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 4.6 | 6.1.185 | 84b205297fa1 |
| 6.12 | 4.6 | 6.12.106 | ee944a706a18 |
| 6.18 | 4.6 | 6.18.46 | 8dbfd8e32a13 |
| 6.6 | 4.6 | 6.6.154 | 28d984a66b9e |
| 7.1 | 4.6 | 7.1.10 | 2e509ef60ee4 |
| mainline | 4.6 | 7.2 | c83e79c0842e |
| cip/6.1 | 4.6 | 6.1.187-cip60 | 84b205297fa1 |
| cip/6.1-rt | 4.6 | 6.1.189-cip61-rt32 | 84b205297fa1 |
| cip/6.12 | 4.6 | 6.12.108-cip31 | ee944a706a18 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |