CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data
In the Linux kernel, the following vulnerability has been resolved:
Input: byd - synchronize timer deletion before freeing private data
byddisconnect() uses timerdelete() before freeing the driver's private data. This does not wait for a running bydcleartouch() callback, which dereferences the private data and its psmouse pointer. A callback racing with disconnect can therefore access the private data after it has been freed. The timer can also still be re-armed by bydprocessbyte() while the disconnect is in progress.
Use timershutdownsync() before freeing the private data: it waits for a running callback and turns any later re-arm attempt into a no-op.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.187-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.107-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.185 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.154 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.106 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.46 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.10 - Compensating control
In the Linux kernel byd driver, use timer_shutdown_sync() instead of timer_delete() before freeing the driver's private data, so running callbacks complete and later timer re-arm attempts become no-ops.
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux kernel's byd input driver are exposed when the driver disconnects while its touch-clear timer callback is running or can be re-armed. The issue concerns the driver's private data and associated psmouse pointer during disconnect.
What condition triggers the use-after-free?
A byd_clear_touch() timer callback must race with byd_disconnect(). The disconnect path can free the driver's private data without waiting for a running callback, and byd_process_byte() can re-arm the timer while disconnect is in progress.
What does the fix change?
The fix replaces timer_delete() with timer_shutdown_sync() before freeing private data. This waits for an active callback to finish and makes subsequent attempts to re-arm the timer no-ops.