{"id":"CVE-2026-80572","title":"Input: byd - synchronize timer deletion before freeing private data","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: byd - synchronize timer deletion before freeing private data\n\nbyd_disconnect() uses timer_delete() before freeing the driver's private\ndata.  This does not wait …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 84b205297fa15f97510342221d8c9a0119711478","Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 28d984a66b9e14be74986167b6ad40b5e0daf19a","Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < ee944a706a18322b4a2599eebe8040a2994e928f","Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 8dbfd8e32a13e116790780ed0be82b5a05eb9916","Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 2e509ef60ee41a2da0deb062c262bb530143fb37","Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < c83e79c0842ed29860648bcce5022ef0ba5001c6","Linux 4.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:17:35.214904Z"},"published":"2026-08-26","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:26:27.388Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80572","references":[{"url":"https://git.kernel.org/stable/c/84b205297fa15f97510342221d8c9a0119711478"},{"url":"https://git.kernel.org/stable/c/28d984a66b9e14be74986167b6ad40b5e0daf19a"},{"url":"https://git.kernel.org/stable/c/ee944a706a18322b4a2599eebe8040a2994e928f"},{"url":"https://git.kernel.org/stable/c/8dbfd8e32a13e116790780ed0be82b5a05eb9916"},{"url":"https://git.kernel.org/stable/c/2e509ef60ee41a2da0deb062c262bb530143fb37"},{"url":"https://git.kernel.org/stable/c/c83e79c0842ed29860648bcce5022ef0ba5001c6"}],"tags":["cve.org"],"epss":0.0012,"epssPercentile":0.01715,"ingestedAt":"2026-10-16T19:46:24.313Z","slug":"CVE-2026-80572","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nInput: byd - synchronize timer deletion before freeing private data\n\nbyd_disconnect() uses timer_delete() before freeing the driver's private\ndata.  This does not wait for a running byd_clear_touch() callback, which\ndereferences the private data and its psmouse pointer.  A callback racing\nwith disconnect can therefore access the private data after it has been\nfreed.  The timer can also still be re-armed by byd_process_byte() while\nthe disconnect is in progress.\n\nUse timer_shutdown_sync() before freeing the private data: it waits for\na running callback and turns any later re-arm attempt into a no-op.\n\n## Affected\n\n- `Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 84b205297fa15f97510342221d8c9a0119711478`\n- `Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 28d984a66b9e14be74986167b6ad40b5e0daf19a`\n- `Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < ee944a706a18322b4a2599eebe8040a2994e928f`\n- `Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 8dbfd8e32a13e116790780ed0be82b5a05eb9916`\n- `Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 2e509ef60ee41a2da0deb062c262bb530143fb37`\n- `Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < c83e79c0842ed29860648bcce5022ef0ba5001c6`\n- `Linux 4.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}