{"id":"CVE-2026-80766","title":"HID: uclogic: fix use-after-free of inrange_timer on remove","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: uclogic: fix use-after-free of inrange_timer on remove\n\nuclogic_remove() cancels the pen in-range timer and then stops the\ndevice:\n\n\ttimer_delete_sync(&drvdata->in…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < f40243358b407aec362fe305fabfcdc94a3abd89","Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < dc5108f18f58870a8dd4203a02a47e571a2be7f0","Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < 9d77ac82e57ead056cf3f71d347083ed9244ad90","Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < e750cdb6de009aace3c77f37fe2173f96175e8e4","Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < 849e537160bbb77fe419ecc3944bfe125dcd441b","Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < f1b3ca06380531f49f988f4721d3ed30b0d7a5d2","Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < f13d0a00204b05e62336da0ab72ea0d87b56690c","Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < 506fd50a9027340f0e9dcc587d10ccb03312dba6","Linux 5.1"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:43:22.787Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80766","references":[{"url":"https://git.kernel.org/stable/c/f40243358b407aec362fe305fabfcdc94a3abd89"},{"url":"https://git.kernel.org/stable/c/dc5108f18f58870a8dd4203a02a47e571a2be7f0"},{"url":"https://git.kernel.org/stable/c/9d77ac82e57ead056cf3f71d347083ed9244ad90"},{"url":"https://git.kernel.org/stable/c/e750cdb6de009aace3c77f37fe2173f96175e8e4"},{"url":"https://git.kernel.org/stable/c/849e537160bbb77fe419ecc3944bfe125dcd441b"},{"url":"https://git.kernel.org/stable/c/f1b3ca06380531f49f988f4721d3ed30b0d7a5d2"},{"url":"https://git.kernel.org/stable/c/f13d0a00204b05e62336da0ab72ea0d87b56690c"},{"url":"https://git.kernel.org/stable/c/506fd50a9027340f0e9dcc587d10ccb03312dba6"}],"tags":["cve.org"],"epss":0.00177,"epssPercentile":0.06758,"ingestedAt":"2026-10-19T10:20:54.953Z","slug":"CVE-2026-80766","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: uclogic: fix use-after-free of inrange_timer on remove\n\nuclogic_remove() cancels the pen in-range timer and then stops the\ndevice:\n\n\ttimer_delete_sync(&drvdata->inrange_timer);\n\thid_hw_stop(hdev);\n\ntimer_delete_sync() only guarantees the timer is idle at that instant.\nuclogic_raw_event_pen() keeps delivering pen reports until hid_hw_stop()\nstops the transport several lines later, and every report with\npen->inrange == UCLOGIC_PARAMS_PEN_INRANGE_NONE re-arms the timer:\n\n\tmod_timer(&drvdata->inrange_timer, jiffies + msecs_to_jiffies(100));\n\nA report landing between the timer_delete_sync() call and the transport\nteardown in hid_hw_stop() re-arms inrange_timer after it was cancelled.\nuclogic_remove() then returns and the devm drvdata is freed, while\nhid_hw_stop() has already freed the input device drvdata->pen_input\npoints at, so when the timer fires ~100 ms later\nuclogic_inrange_timeout() dereferences freed memory -- a use-after-free\nin timer-softirq context.\n\nSwapping the two calls is not a fix: stopping the device first frees\ndrvdata->pen_input via hidinput_disconnect() while the timer may still\nbe pending, so a timer already armed before removal fires on the freed\ninput device in the window before timer_delete_sync() runs.\n\nUse timer_shutdown_sync() before hid_hw_stop() instead. It cancels the\ntimer, waits for a running callback while pen_input is still valid, and\nprevents any further re-arming -- a later mod_timer() from an in-flight\nreport is silently ignored -- so the timer is provably dead before\nhid_hw_stop() frees the inputs. This is the ordering the timer core\ndocuments for this \"timer re-armed from another path\" teardown case.\n\n## Affected\n\n- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < f40243358b407aec362fe305fabfcdc94a3abd89`\n- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < dc5108f18f58870a8dd4203a02a47e571a2be7f0`\n- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < 9d77ac82e57ead056cf3f71d347083ed9244ad90`\n- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < e750cdb6de009aace3c77f37fe2173f96175e8e4`\n- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < 849e537160bbb77fe419ecc3944bfe125dcd441b`\n- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < f1b3ca06380531f49f988f4721d3ed30b0d7a5d2`\n- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < f13d0a00204b05e62336da0ab72ea0d87b56690c`\n- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < 506fd50a9027340f0e9dcc587d10ccb03312dba6`\n- `Linux 5.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}