Executive brief
The Linux kernel's BYD touchpad driver incorrectly freed driver memory while a timer callback could still be running, allowing the callback to access freed data. This race condition could lead to system crashes or unpredictable behavior affecting any system using a BYD touchpad input device.
Technical details
This is a use-after-free vulnerability in the BYD mouse driver (drivers/input/mouse/byd.c) caused by improper timer shutdown in the disconnect handler. The byd_disconnect() function called timer_delete() to remove an active timer before freeing the driver's private data structure, but this did not wait for an in-flight byd_clear_touch() callback that dereferences the private data. Additionally, byd_process_byte() could re-arm the timer during disconnect. The fix replaces timer_delete() with timer_shutdown_sync(), which synchronously waits for any running callback to complete and prevents future re-arm attempts. The vulnerability affects kernel versions from the introduction of the byd driver through those patched in late August 2026. Local or adjacent access to the input device is required; the attack surface is typically limited to local users or DMA-capable peripherals.
Affected products
- Linux Linux kernel All versions with byd driver (from 2d5f5611dd0d onwards); patched in 6.12 and later stable branches as of 2026-08-26
Timeline
- 2026-08-26: disclosed: CVE-2026-80572 published
- 2026-07-20: patched: Upstream fix authored by Linmao Li
- 2026-08-23: patched: Patch applied to stable kernel branches