Executive brief
The Linux kernel's sur40 touchscreen driver had a race condition in device initialization where an input device was registered before the underlying video processing components were ready. If a user opened the device immediately after registration, a worker thread would crash when accessing uninitialized memory structures. The fix reorders initialization steps to ensure all components are fully set up before the input device becomes accessible to userspace.
Technical details
This is a race condition and improper error handling vulnerability in the sur40 USB touchscreen driver. The vulnerability occurs when input_register_device() is called early in sur40_probe() before V4L2 video device and vb2_queue structures are initialized. If userspace immediately opens the input device, sur40_open() triggers the sur40_poll() worker thread, which calls sur40_process_video() and accesses the uninitialized vb2_queue, causing a data race and potential kernel panic. Additionally, if V4L2 registration fails after input_register_device() succeeds, the error path incorrectly calls input_free_device() on a registered device instead of input_unregister_device(), corrupting input subsystem state. The fix moves input_register_device() to the end of sur40_probe() and input_unregister_device() to the beginning of sur40_disconnect() to maintain strict initialization/teardown ordering. The vulnerability requires local access to trigger and affects the Linux kernel on systems with sur40 devices.
Affected products
- Linux Linux kernel Multiple versions (sur40 driver module)
Timeline
- 2026-08-26: disclosed
- 2026-06-15: patched: Fix committed upstream by Dmitry Torokhov