CVE-2026-80572High· 7.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait …

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 26, 2026

Updated

Oct 16, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.12% · p2

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.1% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 51 days

Aug 26, 2026Published
Disclosed via NVD
Oct 16, 2026Record revised
Last analysed / modified upstream
Oct 16, 2026EPSS first tracked
0.1%

Linux #nvd #cve.org

Affected

Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 84b205297fa15f97510342221d8c9a0119711478
Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 28d984a66b9e14be74986167b6ad40b5e0daf19a
Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < ee944a706a18322b4a2599eebe8040a2994e928f
Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 8dbfd8e32a13e116790780ed0be82b5a05eb9916
Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 2e509ef60ee41a2da0deb062c262bb530143fb37
Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < c83e79c0842ed29860648bcce5022ef0ba5001c6
Linux 4.6

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

Input: byd - synchronize timer deletion before freeing private data

byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait for a running byd_clear_touch() callback, which dereferences the private data and its psmouse pointer. A callback racing with disconnect can therefore access the private data after it has been freed. The timer can also still be re-armed by byd_process_byte() while the disconnect is in progress.

Use timer_shutdown_sync() before freeing the private data: it waits for a running callback and turns any later re-arm attempt into a no-op.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org

← Back to feed

CVE-2026-80572High· 7.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 26, 2026

Updated

Oct 16, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.12% · p2

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.1% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 51 days

Aug 26, 2026Published
Disclosed via NVD
Oct 16, 2026Record revised
Last analysed / modified upstream
Oct 16, 2026EPSS first tracked
0.1%

Linux #nvd #cve.org

Affected

Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 84b205297fa15f97510342221d8c9a0119711478
Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 28d984a66b9e14be74986167b6ad40b5e0daf19a
Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < ee944a706a18322b4a2599eebe8040a2994e928f
Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 8dbfd8e32a13e116790780ed0be82b5a05eb9916
Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < 2e509ef60ee41a2da0deb062c262bb530143fb37
Linux >= 2d5f5611dd0de52e9a52b56391a7049a52184e72 < c83e79c0842ed29860648bcce5022ef0ba5001c6
Linux 4.6

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

Input: byd - synchronize timer deletion before freeing private data

Use timer_shutdown_sync() before freeing the private data: it waits for a running callback and turns any later re-arm attempt into a no-op.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org