CVE-2026-80559

A flaw was found in the Linux kernel's sur40 input device driver. Due to improper ordering of device registration, a local user could trigger a race condition by opening the input device immediately after its registration. This could lead to the system accessing uninitialized data, resulting in a system crash. Furthermore, incorrect error handling in the driver could corrupt the input core state.

A flaw of MODERATE severity was found in the Linux kernel sur40 input device driver. In sur40_probe(), the input device was registered before the V4L2 video device and vb2_queue components were fully initialized. A local user with low privileges could open the input device immediately after registration, causing the sur40 polling worker thread to start and access the uninitialized vb2_queue structure in a data race, which could crash the system. In addition, if V4L2 or video registration failed after the input device had been registered, the driver's error path incorrectly called input_free_device() on a successfully registered device, potentially corrupting the input core state. Red Hat rates this flaw MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with low privileges and the impact is limited to system availability. This differs from the upstream CVE record, which assigns a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) by also assuming high confidentiality and integrity impacts that the technical evidence does not support. All currently listed Red Hat product versions for this flaw, including Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel components, are marked NOTAFFECTED because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.