Description

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait for a running byd_clear_touch() callback, which dereferences the private data and its psmouse pointer. A callback racing with disconnect can therefore access the private data after it has been freed. The timer can also still be re-armed by byd_process_byte() while the disconnect is in progress. Use timer_shutdown_sync() before freeing the private data: it waits for a running callback and turns any later re-arm attempt into a no-op.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:13.140Z",
  "pubdate": "2026-08-26T15:17:13.140Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel's byd input driver, stemming from improper synchronization during the device disconnection process.\nThe vulnerability type is a race condition leading to a use-after-free, which impacts the stability and security of the Linux kernel.\nThe flaw specifically affects the byd_disconnect() function, which fails to adequately terminate the timer associated with the driver before the private data structure is deallocated.\nAn attacker capable of triggering a device disconnect while simultaneously forcing the execution of the byd_process_byte() or byd_clear_touch() routines can induce a race condition.\nExploitation allows for access to freed memory, potentially leading to kernel panics, denial-of-service, or arbitrary code execution depending on the state of the heap allocator at the time of the use-after-free.\nThis vulnerability is localized to the byd input driver; no remote network exposure is typically required, as exploitation generally necessitates local access to the system to manipulate the physical or virtualized input device state.",
  "technicalDetails": "The root cause of this vulnerability is the use of timer_delete() within the byd_disconnect() function. The timer_delete() function does not guarantee that a running timer callback—in this case, byd_clear_touch()—has completed its execution before proceeding to free the driver's private data.\nWhen byd_disconnect() is invoked during a device removal, it initiates the cleanup process. However, if the byd_clear_touch() callback is currently executing on a concurrent CPU, it retains a pointer to the driver's private data structure and the associated psmouse object. Because timer_delete() is non-blocking regarding the callback completion, the system proceeds to kfree the private data structure while the timer callback is still referencing it.\nFurthermore, the input driver logic allows for the re-arming of the timer via the byd_process_byte() function. During a disconnect event, if the system is still processing incoming bytes, byd_process_byte() can re-arm the timer after the initial deletion attempt but before the memory is fully unmapped or repurposed. This creates a window where the timer logic is active while the primary driver context is being destroyed.\nThe exploitation flow follows this sequence: 1) The attacker initiates a disconnect event for the BYD input device. 2) The system calls byd_disconnect(), which invokes timer_delete() but does not block until the handler exits. 3) The memory for the private data structure is released via kernel memory management functions. 4) The racing byd_clear_touch() callback executes or is scheduled, attempting to dereference the now-freed private data and its nested psmouse pointer. 5) A kernel use-after-free condition is triggered, leading to memory corruption or system crashes.\nThis vulnerability resides in the byd driver component of the Linux kernel input subsystem. It requires the attacker to have sufficient local privileges to trigger device disconnection and event processing, often necessitating physical access or the ability to inject events into the kernel input subsystem through established interfaces."
}