CVE-2026-80572

A flaw was found in the Linux kernel's byd input driver. A race condition exists during device disconnection where the byd_disconnect() function frees private data before ensuring that a timer callback, byd_clear_touch(), has completed. This can lead to the callback attempting to access memory after it has been freed, potentially resulting in system instability or denial of service.

A MODERATE severity use-after-free flaw exists in the Linux kernel's BYD touchpad (psmouse) driver, shipped in the kernel and kernel-rt components of Red Hat Enterprise Linux 8, 9, and 10 and in the kernel and kernel-ivos-qualcomm components of Red Hat In-Vehicle OS 2.0 and 2.1. When a BYD input device is disconnected, byd_disconnect() calls timer_delete() and then frees the driver's private data without waiting for a byd_clear_touch() timer callback that is already running and dereferences that private data and its psmouse pointer; the timer can also be re-armed by byd_process_byte() while disconnection is still in progress. A local user able to trigger disconnection of a BYD input device while input activity keeps the timer active could win this race and cause the kernel to access freed memory, resulting in a kernel crash and denial of service. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in their kernels. The upstream CVE record is scored 7.8 (Important) with high confidentiality and integrity impact; Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the realistic impact on the affected products is limited to availability. Given the moderate rating, the narrow timing window of the race on the device disconnect path, and the requirement for BYD touchpad hardware to be present, the fix is currently deferred for the affected update streams; the residual risk is a local denial of service on systems using BYD touchpads.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.