GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80572 (GCVE-0-2026-80572)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 12:40
VLAI
Title
Input: byd - synchronize timer deletion before freeing private data
Summary
In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait for a running byd_clear_touch() callback, which dereferences the private data and its psmouse pointer. A callback racing with disconnect can therefore access the private data after it has been freed. The timer can also still be re-armed by byd_process_byte() while the disconnect is in progress. Use timer_shutdown_sync() before freeing the private data: it waits for a running callback and turns any later re-arm attempt into a no-op.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2d5f5611dd0de52e9a52b56391a7049a52184e72 , < 84b205297fa15f97510342221d8c9a0119711478 (git)
Affected: 2d5f5611dd0de52e9a52b56391a7049a52184e72 , < 28d984a66b9e14be74986167b6ad40b5e0daf19a (git)
Affected: 2d5f5611dd0de52e9a52b56391a7049a52184e72 , < ee944a706a18322b4a2599eebe8040a2994e928f (git)
Affected: 2d5f5611dd0de52e9a52b56391a7049a52184e72 , < 8dbfd8e32a13e116790780ed0be82b5a05eb9916 (git)
Affected: 2d5f5611dd0de52e9a52b56391a7049a52184e72 , < 2e509ef60ee41a2da0deb062c262bb530143fb37 (git)
Affected: 2d5f5611dd0de52e9a52b56391a7049a52184e72 , < c83e79c0842ed29860648bcce5022ef0ba5001c6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 6.1.185 , ≤ 6.1.* (semver)
Unaffected: 6.6.154 , ≤ 6.6.* (semver)
Unaffected: 6.12.106 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/mouse/byd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "84b205297fa15f97510342221d8c9a0119711478",
              "status": "affected",
              "version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
              "versionType": "git"
            },
            {
              "lessThan": "28d984a66b9e14be74986167b6ad40b5e0daf19a",
              "status": "affected",
              "version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
              "versionType": "git"
            },
            {
              "lessThan": "ee944a706a18322b4a2599eebe8040a2994e928f",
              "status": "affected",
              "version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
              "versionType": "git"
            },
            {
              "lessThan": "8dbfd8e32a13e116790780ed0be82b5a05eb9916",
              "status": "affected",
              "version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
              "versionType": "git"
            },
            {
              "lessThan": "2e509ef60ee41a2da0deb062c262bb530143fb37",
              "status": "affected",
              "version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
              "versionType": "git"
            },
            {
              "lessThan": "c83e79c0842ed29860648bcce5022ef0ba5001c6",
              "status": "affected",
              "version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/mouse/byd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: byd - synchronize timer deletion before freeing private data\n\nbyd_disconnect() uses timer_delete() before freeing the driver\u0027s private\ndata.  This does not wait for a running byd_clear_touch() callback, which\ndereferences the private data and its psmouse pointer.  A callback racing\nwith disconnect can therefore access the private data after it has been\nfreed.  The timer can also still be re-armed by byd_process_byte() while\nthe disconnect is in progress.\n\nUse timer_shutdown_sync() before freeing the private data: it waits for\na running callback and turns any later re-arm attempt into a no-op."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable from local PS/2 input: BYD packets enter via serio_interrupt() from built-in touchpad hardware or userio-emulated SERIO_8042 port; byd_process_byte()/byd_disconnect() are not network-exposed.\nAC:L - An attacker can arm the 64ms byd_clear_touch timer via touch/relative packets while concurrently closing userio or unbinding the port to invoke byd_disconnect(), controlling both sides of the disconnect/timer race.\nPR:L - Exploitation needs only local access to the PS/2 touchpad or /dev/userio to inject packets and trigger teardown; no init-namespace root, CAP_SYS_ADMIN, or write access to psmouse sysfs is required.\nUI:N - The attacker supplies touchpad traffic and drives device disconnect/emulation teardown themselves; no separate victim interaction (mount, plug-in approval, or click) is needed.\nS:U - Corruption stays within the host kernel address space during PS/2 driver teardown; it is standard local privilege escalation, not a guest-to-host or sandbox boundary crossing.\nC:H - byd_clear_touch() dereferences freed byd_data (priv-\u003epsmouse) and can read attacker-reclaimed slab contents, enabling kernel pointer disclosure and broader arbitrary read primitives typical of heap use-after-free bugs.\nI:H - The timer callback writes into freed byd_data fields and may call input/report helpers through a stale psmouse pointer, giving heap corruption and a path to arbitrary kernel writes or control-flow hijacking.\nA:H - Racing the timer with disconnect can cause invalid pointer dereferences, use-after-free access, kernel oops, or panic during input teardown; the condition is repeatable by re-arming the timer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:40:19.284Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/84b205297fa15f97510342221d8c9a0119711478"
        },
        {
          "url": "https://git.kernel.org/stable/c/28d984a66b9e14be74986167b6ad40b5e0daf19a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee944a706a18322b4a2599eebe8040a2994e928f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dbfd8e32a13e116790780ed0be82b5a05eb9916"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e509ef60ee41a2da0deb062c262bb530143fb37"
        },
        {
          "url": "https://git.kernel.org/stable/c/c83e79c0842ed29860648bcce5022ef0ba5001c6"
        }
      ],
      "title": "Input: byd - synchronize timer deletion before freeing private data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80572",
    "datePublished": "2026-08-26T14:37:33.141Z",
    "dateReserved": "2026-08-26T14:34:25.768Z",
    "dateUpdated": "2026-08-27T12:40:19.284Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80572",
      "date": "2026-09-17",
      "epss": "0.0012",
      "percentile": "0.02104"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-27T01:06:33.000Z",
      "cve": "CVE-2026-80572",
      "id": "msrc_CVE-2026-80572",
      "initial_release_date": "2026-08-27T01:06:33.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Input: byd - synchronize timer deletion before freeing private data",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80572.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80572\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:13.140\",\"lastModified\":\"2026-08-27T13:18:40.680\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nInput: byd - synchronize timer deletion before freeing private data\\n\\nbyd_disconnect() uses timer_delete() before freeing the driver\u0027s private\\ndata.  This does not wait for a running byd_clear_touch() callback, which\\ndereferences the private data and its psmouse pointer.  A callback racing\\nwith disconnect can therefore access the private data after it has been\\nfreed.  The timer can also still be re-armed by byd_process_byte() while\\nthe disconnect is in progress.\\n\\nUse timer_shutdown_sync() before freeing the private data: it waits for\\na running callback and turns any later re-arm attempt into a no-op.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/input/mouse/byd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2d5f5611dd0de52e9a52b56391a7049a52184e72\",\"lessThan\":\"84b205297fa15f97510342221d8c9a0119711478\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d5f5611dd0de52e9a52b56391a7049a52184e72\",\"lessThan\":\"28d984a66b9e14be74986167b6ad40b5e0daf19a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d5f5611dd0de52e9a52b56391a7049a52184e72\",\"lessThan\":\"ee944a706a18322b4a2599eebe8040a2994e928f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d5f5611dd0de52e9a52b56391a7049a52184e72\",\"lessThan\":\"8dbfd8e32a13e116790780ed0be82b5a05eb9916\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d5f5611dd0de52e9a52b56391a7049a52184e72\",\"lessThan\":\"2e509ef60ee41a2da0deb062c262bb530143fb37\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d5f5611dd0de52e9a52b56391a7049a52184e72\",\"lessThan\":\"c83e79c0842ed29860648bcce5022ef0ba5001c6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/input/mouse/byd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.185\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.154\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.106\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/28d984a66b9e14be74986167b6ad40b5e0daf19a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2e509ef60ee41a2da0deb062c262bb530143fb37\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/84b205297fa15f97510342221d8c9a0119711478\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8dbfd8e32a13e116790780ed0be82b5a05eb9916\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c83e79c0842ed29860648bcce5022ef0ba5001c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ee944a706a18322b4a2599eebe8040a2994e928f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T10:44:01+00:00",
      "cve": "CVE-2026-80572",
      "id": "CVE-2026-80572",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Input: byd - synchronize timer deletion before freeing private data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80572.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:11:20Z",
      "cve": "CVE-2026-80572",
      "id": "CVE-2026-80572",
      "initial_release_date": "2026-08-27T00:11:37Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80572",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80572.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.