CVE-2026-80559: Linux Kernel sur40 Race Condition Vulnerability

CVE-2026-80559 Overview

CVE-2026-80559 is a race condition vulnerability in the Linux kernel sur40 input driver. The flaw stems from incorrect ordering of input_register_device() in sur40_probe(), which registered the input device before the V4L2 video device and vb2_queue structures were fully initialized. A local attacker who opens the input device immediately after registration can trigger the sur40_poll() worker thread, which accesses uninitialized memory in sur40_process_video() and causes a data race with potential system crash consequences.

Critical Impact

Local attackers with device access can trigger a kernel data race leading to memory corruption, denial of service, or potential local privilege escalation.

Affected Products

• Linux kernel versions containing the sur40 driver prior to the fix commits
• Systems with Microsoft PixelSense (sur40) touchscreen hardware
• Multiple stable kernel branches (patches backported across eight commits)

Discovery Timeline

• 2026-08-26 - CVE-2026-80559 published to NVD
• 2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80559

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] combined with use of uninitialized data in the sur40_probe() initialization sequence. In the vulnerable code path, input_register_device() was invoked before the V4L2 video subsystem and vb2_queue buffer queue structures completed initialization.

Once the input device becomes visible to userspace, any process can call open() on it. This invokes sur40_open(), which schedules the sur40_poll() worker thread. The worker calls sur40_process_video() and dereferences the not-yet-initialized vb2_queue, producing a data race and undefined behavior in kernel context.

A secondary defect exists in the error path. If V4L2 or video registration fails after input_register_device() succeeds, the cleanup code calls input_free_device() on an already-registered device instead of input_unregister_device(). This corrupts input core state and leaves dangling references in kernel data structures.

Root Cause

The root cause is incorrect ordering of subsystem initialization and teardown in the USB probe callback. The driver exposed a functional userspace interface before all dependent kernel structures were ready. The error unwinding also violated Last-In, First-Out (LIFO) teardown semantics.

Attack Vector

Exploitation requires local access with permission to open the sur40 input device node (typically under /dev/input/). An unprivileged process that opens the device during the narrow window between input_register_device() and completion of V4L2 initialization can trigger the race. The resulting memory corruption in kernel space creates conditions for denial of service and potentially further exploitation.

The vulnerability manifests in the sur40_probe() initialization function within drivers/input/touchscreen/sur40.c. Refer to the upstream commit dab741c9da72 for the reordering fix.

Detection Methods for CVE-2026-80559

Indicators of Compromise

• Kernel oops or panic messages referencing sur40_process_video or vb2_queue in dmesg or journalctl -k output
• KASAN or UBSAN reports flagging uninitialized reads in the sur40 driver
• Unexpected reboots or hangs on systems with attached Microsoft PixelSense (SUR40) hardware

Detection Strategies

• Inventory kernel versions across Linux endpoints and identify hosts running unpatched kernels with the sur40 module loaded (lsmod | grep sur40)
• Monitor for processes opening /dev/input/event* nodes belonging to the sur40 device shortly after USB device attachment
• Enable kernel runtime hardening (CONFIG_KASAN, CONFIG_SLUB_DEBUG) in test environments to surface the race during validation

Monitoring Recommendations

• Forward kernel logs to a centralized logging platform and alert on kernel oops signatures referencing input or V4L2 subsystems
• Track USB device insertion events on systems where the sur40 driver is loaded
• Correlate unprivileged process activity against input device nodes to identify anomalous access patterns

How to Mitigate CVE-2026-80559

Immediate Actions Required

• Apply the upstream stable kernel updates that include the reordering fix for sur40_probe() and sur40_disconnect()
• If patching is not immediately feasible, unload the sur40 module (modprobe -r sur40) on systems where the driver is not required
• Restrict physical and USB port access on systems that must run vulnerable kernels with sur40 hardware

Patch Information

The fix moves input_register_device() to the very end of sur40_probe() so V4L2 and vb2_queue structures are fully initialized before userspace can trigger polling. It also moves input_unregister_device() to the beginning of sur40_disconnect() to enforce LIFO teardown. The fix has been backported across multiple stable branches. See the following commits: 3e8ed76, 5c1c522, 764b507, 83aa12f, 9da976e, beb9b0b, cd4ecce, and dab741c.

Workarounds

• Blacklist the sur40 kernel module on systems that do not require Microsoft PixelSense support by adding blacklist sur40 to /etc/modprobe.d/blacklist.conf
• Tighten permissions on /dev/input/ device nodes via udev rules to restrict access to trusted users only
• Disable USB hot-plug for untrusted devices using kernel USB authorization controls (/sys/bus/usb/devices/*/authorized)