CVE-2026-80766

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the HID uclogic component. The uclogic remove() function uses timer delete sync() to cancel the pen in-range timer before calling hid hw stop(). However, uclogic raw event pen() can continue delivering reports that re-arm the inrange timer via mod timer() before the transport is fully stopped. If the timer is re-armed after being cancelled but before the device is stopped, the uclogic inrange timeout() function may dereference freed memory when the timer eventually fires, leading to a use-after-free in the timer-softirq context.

Recommendations Replace the call to timer delete sync() with timer shutdown sync() before calling hid hw stop() to ensure the timer is cancelled and cannot be re-armed.