CVE-2026-80559

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the sur40 probe() function where input register device() is called before the V4L2 video device and vb2 queue components are fully initialized. If a userspace process opens the input device immediately after registration, the sur40 open() function triggers the sur40 poll() worker thread. This thread then calls sur40 process video(), which accesses the uninitialized vb2 queue structure, resulting in a data race and a potential system crash. Additionally, if V4L2 or video registration fails after the input device is registered, the system incorrectly calls input free device() instead of input unregister device(), which corrupts the input core state.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.