Description
In the Linux kernel, the following vulnerability has been resolved:

Input: sur40 - fix input device registration ordering

In sur40_probe(), input_register_device() was previously called early before
the V4L2 video device and vb2_queue components were fully initialized. If
userspace opened the input device immediately upon registration, sur40_open()
would trigger and start the sur40_poll() worker thread. This worker thread
invokes sur40_process_video() and accesses the uninitialized vb2_queue
structure, leading to a data race and potential system crash.

Furthermore, if V4L2 or video registration failed after input_register_device()
succeeded, the error path fell through to calling input_free_device() on a
successfully registered device instead of input_unregister_device(), corrupting
input core state.

Move input_register_device() to the very end of sur40_probe(). This ensures
the V4L2 and video queue structures are fully initialized before polling can
start, and naturally resolves the error path bug since input_free_device()
is now only called when input registration has not yet occurred.

To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move
input_unregister_device() to the very beginning of sur40_disconnect(). This
guarantees that the input polling worker thread is stopped before V4L2
video components or control handlers are unregistered.
Published: 2026-08-26
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The sur40 input driver in the Linux kernel contains a race condition and improper initialization bug. During probe, the driver registers the input device before the V4L2 and vb2_queue components are fully prepared. If a user‑space process opens the device immediately, the kernel starts the sur40_poll() thread which calls sur40_process_video() and uses the uninitialised vb2_queue structure. This race can lead to kernel memory corruption and a system crash, effectively a denial‑of‑service. An additional error path frees the device after successful registration, potentially corrupting input core state.

Affected Systems

Linux kernel drivers that use the sur40 input module are affected. Any kernel version containing the bug prior to the described commit is vulnerable; the exact version range is not specified.

Risk and Exploitability

The flaw results in a data race that can crash the system. No CVSS score, EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is local: a user‑space application that opens the sur40 input device immediately after driver registration. Although no public exploit is documented, the crash potential makes the risk high for any system allowing such access.

Generated by OpenCVE AI on August 26, 2026 at 16:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the sur40 registration ordering fix, or apply the kernel patch that moves input_register_device() to the end of sur40_probe() and input_unregister_device() to the beginning of sur40_disconnect().
  • If an immediate kernel update is not possible, minimize exposure by preventing user‑space processes from accessing the sur40 input device until the driver has fully probed; this can be achieved by temporarily disabling the sur40 module or restricting /dev/input Sur40 device access with udev rules.
  • After applying the fix or mitigation, monitor kernel logs (dmesg) for any sur40 or V4L2 related instability and verify that the driver no longer triggers data‑race conditions.

Generated by OpenCVE AI on August 26, 2026 at 16:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665
CWE-847

Wed, 26 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40_probe(), input_register_device() was previously called early before the V4L2 video device and vb2_queue components were fully initialized. If userspace opened the input device immediately upon registration, sur40_open() would trigger and start the sur40_poll() worker thread. This worker thread invokes sur40_process_video() and accesses the uninitialized vb2_queue structure, leading to a data race and potential system crash. Furthermore, if V4L2 or video registration failed after input_register_device() succeeded, the error path fell through to calling input_free_device() on a successfully registered device instead of input_unregister_device(), corrupting input core state. Move input_register_device() to the very end of sur40_probe(). This ensures the V4L2 and video queue structures are fully initialized before polling can start, and naturally resolves the error path bug since input_free_device() is now only called when input registration has not yet occurred. To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move input_unregister_device() to the very beginning of sur40_disconnect(). This guarantees that the input polling worker thread is stopped before V4L2 video components or control handlers are unregistered.
Title Input: sur40 - fix input device registration ordering
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-26T14:37:25.371Z

Reserved: 2026-08-26T14:34:25.767Z

Link: CVE-2026-80559

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T15:17:10.690

Modified: 2026-08-26T15:17:10.690

Link: CVE-2026-80559

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T16:45:08Z

Weaknesses