CVE-2026-80766
Received Received - Intake

Use-After-Free in Linux Kernel HID uclogic Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: fix use-after-free of inrange_timer on remove uclogic_remove() cancels the pen in-range timer and then stops the device: timer_delete_sync(&drvdata->inrange_timer); hid_hw_stop(hdev); timer_delete_sync() only guarantees the timer is idle at that instant. uclogic_raw_event_pen() keeps delivering pen reports until hid_hw_stop() stops the transport several lines later, and every report with pen->inrange == UCLOGIC_PARAMS_PEN_INRANGE_NONE re-arms the timer: mod_timer(&drvdata->inrange_timer, jiffies + msecs_to_jiffies(100)); A report landing between the timer_delete_sync() call and the transport teardown in hid_hw_stop() re-arms inrange_timer after it was cancelled. uclogic_remove() then returns and the devm drvdata is freed, while hid_hw_stop() has already freed the input device drvdata->pen_input points at, so when the timer fires ~100 ms later uclogic_inrange_timeout() dereferences freed memory -- a use-after-free in timer-softirq context. Swapping the two calls is not a fix: stopping the device first frees drvdata->pen_input via hidinput_disconnect() while the timer may still be pending, so a timer already armed before removal fires on the freed input device in the window before timer_delete_sync() runs. Use timer_shutdown_sync() before hid_hw_stop() instead. It cancels the timer, waits for a running callback while pen_input is still valid, and prevents any further re-arming -- a later mod_timer() from an in-flight report is silently ignored -- so the timer is provably dead before hid_hw_stop() frees the inputs. This is the ordering the timer core documents for this "timer re-armed from another path" teardown case.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80766
EUVD
EUVD-2026-71409

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's HID subsystem, specifically in the uclogic driver for certain USB input devices. The issue occurs when the device is removed. The timer responsible for tracking pen in-range status is canceled but not properly shut down before the device's resources are freed. A pending timer event can still fire after the memory it references has been deallocated, leading to a use-after-free in timer-softirq context.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID subsystem and does not have network-based detection methods. Detection requires checking the kernel version and verifying if the affected uclogic driver is present. Use commands like 'uname -a' to check kernel version and 'lsmod | grep uclogic' to see if the driver is loaded.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a use-after-free condition, potentially causing system instability, crashes, or privilege escalation. Since it occurs in the kernel's HID subsystem, it affects devices using the uclogic driver, such as certain USB pen or tablet input devices.

Mitigation Strategies

Apply the kernel patch that fixes this issue by updating to a version where timer_shutdown_sync() is used before hid_hw_stop(). Alternatively, disable the uclogic driver if not needed. Monitor vendor advisories for kernel updates addressing this CVE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart