Input Device Registration Vulnerability in Linux Kernel Affects Video Components

CVE-2026-80559

What is CVE-2026-80559?

This vulnerability in the Linux kernel relates to the registration ordering of input devices, notably the sur40 driver. The issue arises because input_register_device() was prematurely called, before the V4L2 video device and associated vb2_queue components were properly initialized. This allowed for a scenario where, if userspace opened the input device immediately, it could result in firing the sur40_poll() worker thread, which then tried to access an uninitialized vb2_queue structure. This condition could lead to a data race, potentially culminating in a system crash. Furthermore, the improper handling during the error path could corrupt the input core state, as input_free_device() was invoked on a successfully registered device instead of properly unregistering it. Adjustments in the sur40_probe() function were made to resolve these issues, ensuring that registration occurs only after full initialization.

References