Executive brief
The Linux kernel's HID uclogic driver contains a use-after-free vulnerability in timer cleanup during device removal. When a pen input device is disconnected, a race condition allows a timer to be re-armed after cancellation, causing it to dereference freed memory milliseconds later. This can lead to kernel crashes or unpredictable behavior when removing affected input devices.
Technical details
The vulnerability is a use-after-free in the uclogic HID driver's timer teardown logic (CVE-2026-80766). The root cause is a race between timer_delete_sync() and hid_hw_stop() during device removal: incoming pen reports can re-arm inrange_timer via mod_timer() after it has been cancelled but before the transport is fully torn down. When the device is freed, the timer fires ~100ms later in softirq context and dereferences already-freed input device memory. The fix replaces timer_delete_sync() with timer_shutdown_sync() before hid_hw_stop(), which not only cancels and waits for the timer but also prevents any future re-arming attempts from in-flight reports. No authentication or network access is required; exploitation occurs automatically during normal device removal.
Affected products
- Linux Linux kernel affected versions prior to the fix (specific version range not disclosed in advisory)
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Fix documented in kernel commit using timer_shutdown_sync()