CVE-2026-80572 - Vulnerability Details

- Input: byd - synchronize timer deletion before freeing private data

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: byd - synchronize timer deletion before freeing private data

byd_disconnect() uses timer_delete() before freeing the driver's private
data. This does not wait for a running byd_clear_touch() callback, which
dereferences the private data and its psmouse pointer. A callback racing
with disconnect can therefore access the private data after it has been
freed. The timer can also still be re-armed by byd_process_byte() while
the disconnect is in progress.

Use timer_shutdown_sync() before freeing the private data: it waits for
a running callback and turns any later re-arm attempt into a no-op.

Published: 2026-08-26

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability in the byd driver is a race condition. During a disconnect, the driver deletes a timer before freeing its private data. If a byd_clear_touch callback runs concurrently, it dereferences that freed memory, causing a use‑after‑free that can crash the kernel or allow privileged code execution. The flaw is a classic race‑condition use‑after‑free weakness (CWE‑364).

Affected Systems

All systems running a Linux kernel version that includes the unpatched byd driver are affected. The CPE entry indicates the Linux kernel, but no specific version range is provided. Any kernel that incorporated the byd driver before the patch may be vulnerable.

Risk and Exploitability

The CVSS score of 7.8 denotes a moderate‑to‑high severity. The EPSS score is less than 1%, indicating a low likelihood of exploitation. The CVE is not listed in the CISA KEV catalog. Exploitation would likely require local interaction with a byd device, such that the attacker can trigger a disconnect while sending data that re‑arms the timer. The description indicates that the use‑after‑free could lead to kernel‑level code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2d5f5611dd0de52e9a52b56391a7049a52184e72`	affected	< 84b205297fa15f97510342221d8c9a0119711478
`2d5f5611dd0de52e9a52b56391a7049a52184e72`	affected	< 28d984a66b9e14be74986167b6ad40b5e0daf19a
`2d5f5611dd0de52e9a52b56391a7049a52184e72`	affected	< ee944a706a18322b4a2599eebe8040a2994e928f
`2d5f5611dd0de52e9a52b56391a7049a52184e72`	affected	< 8dbfd8e32a13e116790780ed0be82b5a05eb9916
`2d5f5611dd0de52e9a52b56391a7049a52184e72`	affected	< 2e509ef60ee41a2da0deb062c262bb530143fb37
`2d5f5611dd0de52e9a52b56391a7049a52184e72`	affected	< c83e79c0842ed29860648bcce5022ef0ba5001c6

Linux

affected

Version	Status	Constraints
`4.6`	affected	—
`0`	unaffected	< 4.6
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2d5f5611dd0de52e9a52b56391a7049a52184e72,8dbfd8e32a13e116790780ed0be82b5a05eb9916)`	affected	code_commit	—
`[2d5f5611dd0de52e9a52b56391a7049a52184e72,2e509ef60ee41a2da0deb062c262bb530143fb37)`	affected	code_commit	—
`[2d5f5611dd0de52e9a52b56391a7049a52184e72,c83e79c0842ed29860648bcce5022ef0ba5001c6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.6`	affected	generic	—
`[0,4.6)`	unaffected	generic	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that patches byd_disconnect by using timer_shutdown_sync() before freeing private data, thereby preventing the use‑after‑free race condition (CWE‑364).
If the update is not yet available, unload or disable the byd driver from the kernel to stop the vulnerable code from executing.
Restrict access to the byd device interface so that only privileged users can interact with it, reducing the chance of a malicious disconnect from untrusted users.

Generated by OpenCVE AI on August 28, 2026 at 20:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6477-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0012.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/28d984a66b9e14be74986167b6ad40b5e0daf19a
https://git.kernel.org/stable/c/2e509ef60ee41a2da0deb062c262bb530143fb37
https://git.kernel.org/stable/c/84b205297fa15f97510342221d8c9a0119711478
https://git.kernel.org/stable/c/8dbfd8e32a13e116790780ed0be82b5a05eb9916
https://git.kernel.org/stable/c/c83e79c0842ed29860648bcce5022ef0ba5001c6
https://git.kernel.org/stable/c/ee944a706a18322b4a2599eebe8040a2994e928f
https://lore.kernel.org/linux-cve-announce/2026082613-CVE-2026-80572-fc32@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80572
https://www.cve.org/CVERecord?id=CVE-2026-80572

History

Fri, 28 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026082613-CVE-2026-80572-fc32@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80572 https://www.cve.org/CVERecord?id=CVE-2026-80572
Metrics	threat_severity `None`	threat_severity `Moderate`

Thu, 27 Aug 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/28d984a66b9e14be74986167b6ad40b5e0daf19a https://git.kernel.org/stable/c/84b205297fa15f97510342221d8c9a0119711478 https://git.kernel.org/stable/c/ee944a706a18322b4a2599eebe8040a2994e928f

Thu, 27 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 26 Aug 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait for a running byd_clear_touch() callback, which dereferences the private data and its psmouse pointer. A callback racing with disconnect can therefore access the private data after it has been freed. The timer can also still be re-armed by byd_process_byte() while the disconnect is in progress. Use timer_shutdown_sync() before freeing the private data: it waits for a running callback and turns any later re-arm attempt into a no-op.
Title		Input: byd - synchronize timer deletion before freeing private data
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2e509ef60ee41a2da0deb062c262bb530143fb37 https://git.kernel.org/stable/c/8dbfd8e32a13e116790780ed0be82b5a05eb9916 https://git.kernel.org/stable/c/c83e79c0842ed29860648bcce5022ef0ba5001c6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:37:33.141Z

Updated: 2026-08-27T12:40:19.284Z

Reserved: 2026-08-26T14:34:25.768Z

Link: CVE-2026-80572

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:17:13.140

Modified: 2026-08-27T13:18:40.680

Link: CVE-2026-80572

Redhat

Severity : Moderate

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-80572 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T20:15:06Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object