CVE-2026-80766

A flaw was found in the Linux kernel's Human Interface Device (HID) uclogic driver. During the removal of a uclogic device, a timing issue allows the inrange_timer to be re-armed after it has been cancelled. This can lead to the timer attempting to access memory that has already been freed, resulting in a use-after-free vulnerability in the kernel's timer-softirq context. This flaw could potentially lead to system instability or a denial of service.

A use-after-free can occur in the HID uclogic remove path because timer_delete_sync() does not prevent inrange_timer from being rearmed by an in flight pen report before hid_hw_stop() stops the transport. A malicious or unstable HID tablet can keep delivering reports during device removal and rearm the timer, so the timer may fire after drvdata or the input device has been freed. For the CVSS the PR:N because the physical device based scenario does not require a local account on the victim, only the ability to interact with the HID transport. The issue is not network reachable and is best modeled as AV:P with AC:H due to the required teardown race window.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.