---
id: CVE-2026-80766
title: 'HID: uclogic: fix use-after-free of inrange_timer on remove'
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: uclogic: fix use-after-free of inrange_timer on remove\n\nuclogic_remove() cancels the pen in-range timer and then stops the\ndevice:\n\n\ttimer_delete_sync(&drvdata->in…"
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 <
    f40243358b407aec362fe305fabfcdc94a3abd89
  - >-
    Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 <
    dc5108f18f58870a8dd4203a02a47e571a2be7f0
  - >-
    Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 <
    9d77ac82e57ead056cf3f71d347083ed9244ad90
  - >-
    Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 <
    e750cdb6de009aace3c77f37fe2173f96175e8e4
  - >-
    Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 <
    849e537160bbb77fe419ecc3944bfe125dcd441b
  - >-
    Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 <
    f1b3ca06380531f49f988f4721d3ed30b0d7a5d2
  - >-
    Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 <
    f13d0a00204b05e62336da0ab72ea0d87b56690c
  - >-
    Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 <
    506fd50a9027340f0e9dcc587d10ccb03312dba6
  - Linux 5.1
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:43:22.787Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80766'
references:
  - url: 'https://git.kernel.org/stable/c/f40243358b407aec362fe305fabfcdc94a3abd89'
  - url: 'https://git.kernel.org/stable/c/dc5108f18f58870a8dd4203a02a47e571a2be7f0'
  - url: 'https://git.kernel.org/stable/c/9d77ac82e57ead056cf3f71d347083ed9244ad90'
  - url: 'https://git.kernel.org/stable/c/e750cdb6de009aace3c77f37fe2173f96175e8e4'
  - url: 'https://git.kernel.org/stable/c/849e537160bbb77fe419ecc3944bfe125dcd441b'
  - url: 'https://git.kernel.org/stable/c/f1b3ca06380531f49f988f4721d3ed30b0d7a5d2'
  - url: 'https://git.kernel.org/stable/c/f13d0a00204b05e62336da0ab72ea0d87b56690c'
  - url: 'https://git.kernel.org/stable/c/506fd50a9027340f0e9dcc587d10ccb03312dba6'
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.06758
ingestedAt: '2026-10-19T10:20:54.953Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

HID: uclogic: fix use-after-free of inrange_timer on remove

uclogic_remove() cancels the pen in-range timer and then stops the
device:

	timer_delete_sync(&drvdata->inrange_timer);
	hid_hw_stop(hdev);

timer_delete_sync() only guarantees the timer is idle at that instant.
uclogic_raw_event_pen() keeps delivering pen reports until hid_hw_stop()
stops the transport several lines later, and every report with
pen->inrange == UCLOGIC_PARAMS_PEN_INRANGE_NONE re-arms the timer:

	mod_timer(&drvdata->inrange_timer, jiffies + msecs_to_jiffies(100));

A report landing between the timer_delete_sync() call and the transport
teardown in hid_hw_stop() re-arms inrange_timer after it was cancelled.
uclogic_remove() then returns and the devm drvdata is freed, while
hid_hw_stop() has already freed the input device drvdata->pen_input
points at, so when the timer fires ~100 ms later
uclogic_inrange_timeout() dereferences freed memory -- a use-after-free
in timer-softirq context.

Swapping the two calls is not a fix: stopping the device first frees
drvdata->pen_input via hidinput_disconnect() while the timer may still
be pending, so a timer already armed before removal fires on the freed
input device in the window before timer_delete_sync() runs.

Use timer_shutdown_sync() before hid_hw_stop() instead. It cancels the
timer, waits for a running callback while pen_input is still valid, and
prevents any further re-arming -- a later mod_timer() from an in-flight
report is silently ignored -- so the timer is provably dead before
hid_hw_stop() frees the inputs. This is the ordering the timer core
documents for this "timer re-armed from another path" teardown case.

## Affected

- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < f40243358b407aec362fe305fabfcdc94a3abd89`
- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < dc5108f18f58870a8dd4203a02a47e571a2be7f0`
- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < 9d77ac82e57ead056cf3f71d347083ed9244ad90`
- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < e750cdb6de009aace3c77f37fe2173f96175e8e4`
- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < 849e537160bbb77fe419ecc3944bfe125dcd441b`
- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < f1b3ca06380531f49f988f4721d3ed30b0d7a5d2`
- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < f13d0a00204b05e62336da0ab72ea0d87b56690c`
- `Linux >= 01309e29eb95c16bd48984f2589fad0cbf5e27d1 < 506fd50a9027340f0e9dcc587d10ccb03312dba6`
- `Linux 5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.