CVE-2026-80766 - Vulnerability Details

- HID: uclogic: fix use-after-free of inrange_timer on remove

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: uclogic: fix use-after-free of inrange_timer on remove

uclogic_remove() cancels the pen in-range timer and then stops the
device:

timer_delete_sync(&drvdata->inrange_timer);
hid_hw_stop(hdev);

timer_delete_sync() only guarantees the timer is idle at that instant.
uclogic_raw_event_pen() keeps delivering pen reports until hid_hw_stop()
stops the transport several lines later, and every report with
pen->inrange == UCLOGIC_PARAMS_PEN_INRANGE_NONE re-arms the timer:

mod_timer(&drvdata->inrange_timer, jiffies + msecs_to_jiffies(100));

A report landing between the timer_delete_sync() call and the transport
teardown in hid_hw_stop() re-arms inrange_timer after it was cancelled.
uclogic_remove() then returns and the devm drvdata is freed, while
hid_hw_stop() has already freed the input device drvdata->pen_input
points at, so when the timer fires ~100 ms later
uclogic_inrange_timeout() dereferences freed memory -- a use-after-free
in timer-softirq context.

Swapping the two calls is not a fix: stopping the device first frees
drvdata->pen_input via hidinput_disconnect() while the timer may still
be pending, so a timer already armed before removal fires on the freed
input device in the window before timer_delete_sync() runs.

Use timer_shutdown_sync() before hid_hw_stop() instead. It cancels the
timer, waits for a running callback while pen_input is still valid, and
prevents any further re-arming -- a later mod_timer() from an in-flight
report is silently ignored -- so the timer is provably dead before
hid_hw_stop() frees the inputs. This is the ordering the timer core
documents for this "timer re-armed from another path" teardown case.

Published: 2026-09-04

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a use‑after‑free in the uclogic HID driver where a timer can be re‑armed after it has been cancelled during device removal. When the timer fires, it dereferences freed memory in kernel space, leading to undefined behavior that can involve kernel memory corruption. This flaw stems from the incorrect ordering of timer shutdown and device teardown calls and violates proper resource cleanup best practices (CWE‑416). The impact is limited to kernel context; successful exploitation could allow privilege escalation or a system crash if an attacker can trigger the timing condition.

Affected Systems

Linux kernel devices that employ the uclogic HID driver. The flaw applies to all kernel builds that include this driver before the patch was applied, regardless of specific kernel versions; no version range was provided in the advisory.

Risk and Exploitability

The CVSS score is not provided and the EPSS score is not available, so the quantified severity and likelihood are unknown. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. The attack vector is inferred to be local and requires interaction with the uclogic HID device during removal, as the flaw occurs during device shutdown. If an attacker can perform local privileged operations that trigger device removal, they could potentially trigger the use‑after‑free.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`01309e29eb95c16bd48984f2589fad0cbf5e27d1`	affected	< f40243358b407aec362fe305fabfcdc94a3abd89
`01309e29eb95c16bd48984f2589fad0cbf5e27d1`	affected	< dc5108f18f58870a8dd4203a02a47e571a2be7f0
`01309e29eb95c16bd48984f2589fad0cbf5e27d1`	affected	< 9d77ac82e57ead056cf3f71d347083ed9244ad90
`01309e29eb95c16bd48984f2589fad0cbf5e27d1`	affected	< e750cdb6de009aace3c77f37fe2173f96175e8e4
`01309e29eb95c16bd48984f2589fad0cbf5e27d1`	affected	< 849e537160bbb77fe419ecc3944bfe125dcd441b
`01309e29eb95c16bd48984f2589fad0cbf5e27d1`	affected	< f1b3ca06380531f49f988f4721d3ed30b0d7a5d2
`01309e29eb95c16bd48984f2589fad0cbf5e27d1`	affected	< f13d0a00204b05e62336da0ab72ea0d87b56690c
`01309e29eb95c16bd48984f2589fad0cbf5e27d1`	affected	< 506fd50a9027340f0e9dcc587d10ccb03312dba6

Linux

affected

Version	Status	Constraints
`5.1`	affected	—
`0`	unaffected	< 5.1
`5.15.220`	unaffected	≤ 5.15.*
`6.1.187`	unaffected	≤ 6.1.*
`6.6.156`	unaffected	≤ 6.6.*
`6.12.108`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[01309e29eb95c16bd48984f2589fad0cbf5e27d1,f40243358b407aec362fe305fabfcdc94a3abd89)`	affected	code_commit	—
`[01309e29eb95c16bd48984f2589fad0cbf5e27d1,dc5108f18f58870a8dd4203a02a47e571a2be7f0)`	affected	code_commit	—
`[01309e29eb95c16bd48984f2589fad0cbf5e27d1,9d77ac82e57ead056cf3f71d347083ed9244ad90)`	affected	code_commit	—
`[01309e29eb95c16bd48984f2589fad0cbf5e27d1,e750cdb6de009aace3c77f37fe2173f96175e8e4)`	affected	code_commit	—
`[01309e29eb95c16bd48984f2589fad0cbf5e27d1,849e537160bbb77fe419ecc3944bfe125dcd441b)`	affected	code_commit	—
`[01309e29eb95c16bd48984f2589fad0cbf5e27d1,f1b3ca06380531f49f988f4721d3ed30b0d7a5d2)`	affected	code_commit	—
`[01309e29eb95c16bd48984f2589fad0cbf5e27d1,f13d0a00204b05e62336da0ab72ea0d87b56690c)`	affected	code_commit	—
`[01309e29eb95c16bd48984f2589fad0cbf5e27d1,506fd50a9027340f0e9dcc587d10ccb03312dba6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.1`	affected	generic	—
`[0,5.1)`	unaffected	generic	—
`[5.15.220,5.16.0)`	unaffected	semver	—
`[6.1.187,6.2.0)`	unaffected	semver	—
`[6.6.156,6.7.0)`	unaffected	semver	—
`[6.12.108,6.13.0)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the fix where timer_shutdown_sync() is used before hid_hw_stop() for the uclogic driver. The patch removes the re‑arming race condition and prevents the use‑after‑free.
Reboot the system after applying the kernel update to ensure the patched driver is loaded.
If a kernel update is not immediately available, disable or disconnect the uclogic HID devices until a compliant kernel version is deployed.

Generated by OpenCVE AI on September 4, 2026 at 17:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/506fd50a9027340f0e9dcc587d10ccb03312dba6
https://git.kernel.org/stable/c/849e537160bbb77fe419ecc3944bfe125dcd441b
https://git.kernel.org/stable/c/9d77ac82e57ead056cf3f71d347083ed9244ad90
https://git.kernel.org/stable/c/dc5108f18f58870a8dd4203a02a47e571a2be7f0
https://git.kernel.org/stable/c/e750cdb6de009aace3c77f37fe2173f96175e8e4
https://git.kernel.org/stable/c/f13d0a00204b05e62336da0ab72ea0d87b56690c
https://git.kernel.org/stable/c/f1b3ca06380531f49f988f4721d3ed30b0d7a5d2
https://git.kernel.org/stable/c/f40243358b407aec362fe305fabfcdc94a3abd89

History

Fri, 04 Sep 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 04 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: fix use-after-free of inrange_timer on remove uclogic_remove() cancels the pen in-range timer and then stops the device: timer_delete_sync(&drvdata->inrange_timer); hid_hw_stop(hdev); timer_delete_sync() only guarantees the timer is idle at that instant. uclogic_raw_event_pen() keeps delivering pen reports until hid_hw_stop() stops the transport several lines later, and every report with pen->inrange == UCLOGIC_PARAMS_PEN_INRANGE_NONE re-arms the timer: mod_timer(&drvdata->inrange_timer, jiffies + msecs_to_jiffies(100)); A report landing between the timer_delete_sync() call and the transport teardown in hid_hw_stop() re-arms inrange_timer after it was cancelled. uclogic_remove() then returns and the devm drvdata is freed, while hid_hw_stop() has already freed the input device drvdata->pen_input points at, so when the timer fires ~100 ms later uclogic_inrange_timeout() dereferences freed memory -- a use-after-free in timer-softirq context. Swapping the two calls is not a fix: stopping the device first frees drvdata->pen_input via hidinput_disconnect() while the timer may still be pending, so a timer already armed before removal fires on the freed input device in the window before timer_delete_sync() runs. Use timer_shutdown_sync() before hid_hw_stop() instead. It cancels the timer, waits for a running callback while pen_input is still valid, and prevents any further re-arming -- a later mod_timer() from an in-flight report is silently ignored -- so the timer is provably dead before hid_hw_stop() frees the inputs. This is the ordering the timer core documents for this "timer re-armed from another path" teardown case.
Title		HID: uclogic: fix use-after-free of inrange_timer on remove
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/506fd50a9027340f0e9dcc587d10ccb03312dba6 https://git.kernel.org/stable/c/849e537160bbb77fe419ecc3944bfe125dcd441b https://git.kernel.org/stable/c/9d77ac82e57ead056cf3f71d347083ed9244ad90 https://git.kernel.org/stable/c/dc5108f18f58870a8dd4203a02a47e571a2be7f0 https://git.kernel.org/stable/c/e750cdb6de009aace3c77f37fe2173f96175e8e4 https://git.kernel.org/stable/c/f13d0a00204b05e62336da0ab72ea0d87b56690c https://git.kernel.org/stable/c/f1b3ca06380531f49f988f4721d3ed30b0d7a5d2 https://git.kernel.org/stable/c/f40243358b407aec362fe305fabfcdc94a3abd89

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:12:38.520Z

Updated: 2026-09-04T15:12:38.520Z

Reserved: 2026-08-26T14:34:25.791Z

Link: CVE-2026-80766

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T16:18:01.923

Modified: 2026-09-04T16:18:01.923

Link: CVE-2026-80766

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T17:30:17Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object