CVE-2026-80559

CVE CVE-2026-80559EUVD EUVD-2026-66474Published 2026-08-26T14:37:25.000ZLast changed 2026-08-27T05:01:47.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40_probe(), input_register_device() was previously called early before the V4L2 video device and vb2_queue components were fully initialized. If userspace opened the input device immediately upon registration, sur40_open() would trigger and start the sur40_poll() worker thread. This worker thread invokes sur40_process_video() and accesses the uninitialized vb2_queue structure, leading to a data race and potential system crash. Furthermore, if V4L2 or video registration failed after input_register_device() succeeded, the error path fell through to calling input_free_device() on a successfully registered device instead of input_unregister_device(), corrupting input core state. Move input_register_device() to the very end of sur40_probe(). This ensures the V4L2 and video queue structures are fully initialized before polling can start, and naturally resolves the error path bug since input_free_device() is now only called when input registration has not yet occurred. To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move input_unregister_device() to the very beginning of sur40_disconnect(). This guarantees that the input polling worker thread is stopped before V4L2 video components or control handlers are unregistered.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 6.18.46; patch: 5.15.217; patch: 7.2; e831cd251fb91d6c25352d322743db0d17ea11dd <83aa12f9f2468a4fbef027c09224dc1011850fb0; patch: 6.6.153; e831cd251fb91d6c25352d322743db0d17ea11dd <beb9b0bd6e6e23f5e9e42b7ef890a50f57f1f3aa; e831cd251fb91d6c25352d322743db0d17ea11dd <5c1c5227c93f18cd329dd754b4df5e0e2daece1e; patch: 5.10.266; patch: 0; patch: 7.1.10; e831cd251fb91d6c25352d322743db0d17ea11dd <cd4ecce2fd87760c0ad9a9d28c9fc62ea1dbfd3d; patch: 6.1.184; e831cd251fb91d6c25352d322743db0d17ea11dd <9da976eb649c9e2f588a4499410e4d8af687925f; e831cd251fb91d6c25352d322743db0d17ea11dd <764b507be7b51787e1f577ca3bf0bab7efe81ff8; 4.1; patch: 6.12.105; e831cd251fb91d6c25352d322743db0d17ea11dd <dab741c9da72102a37cc1020a929051b7c45f9fb; e831cd251fb91d6c25352d322743db0d17ea11dd <3e8ed76a4f3572e637653f0654cccdf617903231

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.