CVE-2026-80559 - Vulnerability Details

- Input: sur40 - fix input device registration ordering

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: sur40 - fix input device registration ordering

In sur40_probe(), input_register_device() was previously called early before
the V4L2 video device and vb2_queue components were fully initialized. If
userspace opened the input device immediately upon registration, sur40_open()
would trigger and start the sur40_poll() worker thread. This worker thread
invokes sur40_process_video() and accesses the uninitialized vb2_queue
structure, leading to a data race and potential system crash.

Furthermore, if V4L2 or video registration failed after input_register_device()
succeeded, the error path fell through to calling input_free_device() on a
successfully registered device instead of input_unregister_device(), corrupting
input core state.

Move input_register_device() to the very end of sur40_probe(). This ensures
the V4L2 and video queue structures are fully initialized before polling can
start, and naturally resolves the error path bug since input_free_device()
is now only called when input registration has not yet occurred.

To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move
input_unregister_device() to the very beginning of sur40_disconnect(). This
guarantees that the input polling worker thread is stopped before V4L2
video components or control handlers are unregistered.

Published: 2026-08-26

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The sur40 input driver in the Linux kernel contains a race condition and improper initialization bug. During probe, the driver registers the input device before the V4L2 and vb2_queue components are fully prepared. If a user‑space process opens the device immediately, the kernel starts the sur40_poll() thread which calls sur40_process_video() and uses an uninitialized vb2_queue structure. This race can lead to kernel memory corruption and a system crash, effectively a denial‑of‑service. An additional error path frees the device after successful registration, potentially corrupting input core state.

Affected Systems

Linux kernel drivers that use the sur40 input module are affected. Any kernel version containing the bug prior to the described commit is vulnerable; the exact version range is not specified.

Risk and Exploitability

The flaw results in a data race that can crash the system. The CVSS score is 7.8, indicating a high severity; EPSS score is < 1%, showing a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is local: a user‑space application that opens the sur40 input device immediately after driver registration. Although no public exploit is documented, the crash potential makes the risk high for any system allowing such access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e831cd251fb91d6c25352d322743db0d17ea11dd`	affected	< cd4ecce2fd87760c0ad9a9d28c9fc62ea1dbfd3d
`e831cd251fb91d6c25352d322743db0d17ea11dd`	affected	< dab741c9da72102a37cc1020a929051b7c45f9fb
`e831cd251fb91d6c25352d322743db0d17ea11dd`	affected	< 764b507be7b51787e1f577ca3bf0bab7efe81ff8
`e831cd251fb91d6c25352d322743db0d17ea11dd`	affected	< 3e8ed76a4f3572e637653f0654cccdf617903231
`e831cd251fb91d6c25352d322743db0d17ea11dd`	affected	< 83aa12f9f2468a4fbef027c09224dc1011850fb0
`e831cd251fb91d6c25352d322743db0d17ea11dd`	affected	< 5c1c5227c93f18cd329dd754b4df5e0e2daece1e
`e831cd251fb91d6c25352d322743db0d17ea11dd`	affected	< beb9b0bd6e6e23f5e9e42b7ef890a50f57f1f3aa
`e831cd251fb91d6c25352d322743db0d17ea11dd`	affected	< 9da976eb649c9e2f588a4499410e4d8af687925f

Linux

affected

Version	Status	Constraints
`4.1`	affected	—
`0`	unaffected	< 4.1
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cd4ecce2fd87760c0ad9a9d28c9fc62ea1dbfd3d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,dab741c9da72102a37cc1020a929051b7c45f9fb)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,764b507be7b51787e1f577ca3bf0bab7efe81ff8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3e8ed76a4f3572e637653f0654cccdf617903231)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,83aa12f9f2468a4fbef027c09224dc1011850fb0)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5c1c5227c93f18cd329dd754b4df5e0e2daece1e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,beb9b0bd6e6e23f5e9e42b7ef890a50f57f1f3aa)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9da976eb649c9e2f588a4499410e4d8af687925f)`	affected	code_commit	—
`[0,5.10.266)`	affected	semver	—
`[0,5.15.217)`	affected	semver	—
`[0,6.1.184)`	affected	semver	—
`[0,6.6.153)`	affected	semver	—
`[0,6.12.105)`	affected	semver	—
`[0,6.18.46)`	affected	semver	—
`[0,7.1.10)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.266,5.10.*]`	unaffected	semver	—
`[5.15.217,5.15.*]`	unaffected	semver	—
`[6.1.184,6.1.*]`	unaffected	semver	—
`[6.6.153,6.6.*]`	unaffected	semver	—
`[6.12.105,6.12.*]`	unaffected	semver	—
`[6.18.46,6.18.*]`	unaffected	semver	—
`[7.1.10,7.1.*]`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a newer version that includes the sur40 registration ordering fix, or apply the kernel patch that moves input_register_device() to the end of sur40_probe() to resolve the data race identified as CWE‑824.
Apply the CIS recommended mitigation for CWE‑824 by restricting access to the /dev/input Sur40 device until the driver has fully probed. This can be done by disabling the sur40 module or configuring udev rules to deny user‑space access until V4L2 has finished initialization.
Monitor kernel logs and system stability for sur40 or V4L2 related instability to detect any remaining race conditions.

Generated by OpenCVE AI on August 28, 2026 at 16:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00129.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3e8ed76a4f3572e637653f0654cccdf617903231
https://git.kernel.org/stable/c/5c1c5227c93f18cd329dd754b4df5e0e2daece1e
https://git.kernel.org/stable/c/764b507be7b51787e1f577ca3bf0bab7efe81ff8
https://git.kernel.org/stable/c/83aa12f9f2468a4fbef027c09224dc1011850fb0
https://git.kernel.org/stable/c/9da976eb649c9e2f588a4499410e4d8af687925f
https://git.kernel.org/stable/c/beb9b0bd6e6e23f5e9e42b7ef890a50f57f1f3aa
https://git.kernel.org/stable/c/cd4ecce2fd87760c0ad9a9d28c9fc62ea1dbfd3d
https://git.kernel.org/stable/c/dab741c9da72102a37cc1020a929051b7c45f9fb
https://lore.kernel.org/linux-cve-announce/2026082610-CVE-2026-80559-9595@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80559
https://www.cve.org/CVERecord?id=CVE-2026-80559

History

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026082610-CVE-2026-80559-9595@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80559 https://www.cve.org/CVERecord?id=CVE-2026-80559
Metrics	threat_severity `None`	threat_severity `Moderate`

Thu, 27 Aug 2026 09:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665 CWE-847

Thu, 27 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 26 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665 CWE-847

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40_probe(), input_register_device() was previously called early before the V4L2 video device and vb2_queue components were fully initialized. If userspace opened the input device immediately upon registration, sur40_open() would trigger and start the sur40_poll() worker thread. This worker thread invokes sur40_process_video() and accesses the uninitialized vb2_queue structure, leading to a data race and potential system crash. Furthermore, if V4L2 or video registration failed after input_register_device() succeeded, the error path fell through to calling input_free_device() on a successfully registered device instead of input_unregister_device(), corrupting input core state. Move input_register_device() to the very end of sur40_probe(). This ensures the V4L2 and video queue structures are fully initialized before polling can start, and naturally resolves the error path bug since input_free_device() is now only called when input registration has not yet occurred. To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move input_unregister_device() to the very beginning of sur40_disconnect(). This guarantees that the input polling worker thread is stopped before V4L2 video components or control handlers are unregistered.
Title		Input: sur40 - fix input device registration ordering
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3e8ed76a4f3572e637653f0654cccdf617903231 https://git.kernel.org/stable/c/5c1c5227c93f18cd329dd754b4df5e0e2daece1e https://git.kernel.org/stable/c/764b507be7b51787e1f577ca3bf0bab7efe81ff8 https://git.kernel.org/stable/c/83aa12f9f2468a4fbef027c09224dc1011850fb0 https://git.kernel.org/stable/c/9da976eb649c9e2f588a4499410e4d8af687925f https://git.kernel.org/stable/c/beb9b0bd6e6e23f5e9e42b7ef890a50f57f1f3aa https://git.kernel.org/stable/c/cd4ecce2fd87760c0ad9a9d28c9fc62ea1dbfd3d https://git.kernel.org/stable/c/dab741c9da72102a37cc1020a929051b7c45f9fb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:37:25.371Z

Updated: 2026-08-27T05:01:47.768Z

Reserved: 2026-08-26T14:34:25.767Z

Link: CVE-2026-80559

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:17:10.690

Modified: 2026-08-27T06:17:40.253

Link: CVE-2026-80559

Redhat

Severity : Moderate

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-80559 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T16:30:17Z

Weaknesses

CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object