CVE-2026-80572 Overview
CVE-2026-80572 is a use-after-free vulnerability in the Linux kernel's BYD touchpad driver (drivers/input/mouse/byd.c). The flaw exists in byd_disconnect(), which calls timer_delete() before freeing the driver's private data. timer_delete() does not wait for a running byd_clear_touch() callback, allowing the callback to dereference freed memory. The timer can also be re-armed by byd_process_byte() during disconnect. A local attacker with the ability to trigger device disconnect races can corrupt kernel memory.
Critical Impact
Local exploitation can lead to kernel memory corruption, information disclosure, or privilege escalation through the use-after-free condition in the BYD input driver.
Affected Products
- Linux kernel versions containing the BYD touchpad driver prior to the fix
- Distributions shipping the vulnerable drivers/input/mouse/byd.c code path
- Stable kernel branches referenced in the upstream fix commits
Discovery Timeline
- 2026-08-26 - CVE-2026-80572 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80572
Vulnerability Analysis
The BYD PS/2 touchpad driver uses a kernel timer to clear stale touch state through the byd_clear_touch() callback. When the device is disconnected, byd_disconnect() invokes timer_delete() and then frees the driver's private data structure. timer_delete() returns immediately without synchronizing with in-flight timer callbacks running on other CPUs.
A callback executing concurrently with disconnect dereferences the private data and its psmouse pointer after the memory has been released. Additionally, byd_process_byte() can re-arm the timer while disconnect is in progress, extending the window during which stale references remain live. The result is a classic use-after-free race condition in a kernel input driver.
Root Cause
The root cause is improper timer lifecycle management during driver teardown. timer_delete() deactivates a pending timer but provides no ordering guarantee against callbacks already executing or timers re-armed by concurrent packet processing. The private data allocation is released without waiting for the callback to complete.
Attack Vector
Exploitation requires local access and interaction with the affected input device. An attacker able to induce disconnect events while touchpad data is being processed can trigger the race. Successful exploitation grants read or write access to freed kernel slab memory, which can be leveraged for privilege escalation or information disclosure.
The upstream fix replaces timer_delete() with timer_shutdown_sync(), which waits for any running callback to finish and converts subsequent re-arm attempts into no-ops. See the Kernel Git Commit 28d984a for the exact patch content.
Detection Methods for CVE-2026-80572
Indicators of Compromise
- Unexpected kernel oops or KASAN reports referencing byd_clear_touch or byd_process_byte
- Slab-use-after-free warnings in dmesg involving the psmouse structure
- Kernel panics correlated with USB or PS/2 touchpad hot-plug events
Detection Strategies
- Enable CONFIG_KASAN on test and pre-production kernels to catch use-after-free accesses in the BYD driver path
- Monitor kernel logs for WARNING or BUG traces mentioning byd.c or timer_delete
- Audit installed kernel packages against distribution advisories referencing the upstream fix commits
Monitoring Recommendations
- Forward kernel ring buffer output to a centralized log aggregation platform for anomaly detection
- Alert on repeated device disconnect events on systems with BYD touchpads
- Track privilege escalation indicators such as unexpected uid=0 process spawns following input subsystem errors
How to Mitigate CVE-2026-80572
Immediate Actions Required
- Apply the stable kernel updates that incorporate the timer_shutdown_sync() fix from the referenced upstream commits
- Inventory systems with BYD touchpad hardware and prioritize patching for multi-user or shared-access endpoints
- Restrict local access on unpatched systems until updates are deployed
Patch Information
The fix replaces timer_delete() with timer_shutdown_sync() in byd_disconnect(), ensuring the timer callback completes before private data is freed and preventing subsequent re-arm. Backports are available across stable branches. Reference the fix commits: Kernel Git Commit 28d984a, Kernel Git Commit 2e509ef, Kernel Git Commit 84b2052, Kernel Git Commit 8dbfd8e, Kernel Git Commit c83e79c, and Kernel Git Commit ee944a7.
Workarounds
- Blacklist the psmouse module's BYD protocol on systems that do not require BYD touchpad support
- Force the psmouse driver to a different protocol via the psmouse.proto= kernel parameter where hardware permits
- Limit physical and local console access to reduce the ability to trigger disconnect races
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
