CVE-2026-80572 Linux CVE debrief

Who should care

Linux system administrators, maintainers, and security teams should assess exposure and apply the patch to prevent potential crashes or undefined behavior. Affected operators and platforms require review and verification of patch application to ensure fix effectiveness. Vulnerability management and security teams need to prioritize patching this vulnerability to prevent potential system crashes or undefined behavior.

Why it matters

Linux system administrators should prioritize patching this vulnerability to prevent potential system crashes or undefined behavior. The vulnerability exists in the Input: byd module and can be triggered by a use-after-free issue. Affected systems require inventory checks and potential patch application.

• Potential system crashes or undefined behavior due to use-after-free vulnerability
• Need to verify patch application and system reboot to ensure fix effectiveness

Technical summary

The Linux kernel's Input: byd module is vulnerable to a use-after-free issue. The `byd_disconnect` function uses `timer_delete` to delete a timer without waiting for any running callbacks, potentially causing a callback to access private data after it has been freed. This issue can be triggered by a use-after-free vulnerability in the `byd_clear_touch` callback, which dereferences the private data and its psmouse pointer. Affected systems require inventory checks and potential patch application to prevent crashes or undefined behavior.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to update the Linux kernel to a version that includes the fix
• Inventory Linux systems using the affected module to assess exposure
• Monitor system logs for potential exploitation attempts
• Verify patch application and system reboot to ensure fix effectiveness
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. However, the corpus does not establish specific exploitation or impact, and remediation priority is not explicitly stated.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.