CVE-2026-80572

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the byd disconnect() function. The function uses timer delete() before freeing the driver's private data, which fails to wait for a running byd clear touch() callback. This callback dereferences the private data and its psmouse pointer, potentially allowing access to private data after it has been freed. Additionally, the timer may be re-armed by the byd process byte() function while the disconnect process is ongoing.

Recommendations Use timer shutdown sync() before freeing the private data to ensure any running callback is completed and subsequent re-arm attempts are ignored.