CVE-2026-80766

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: uclogic: fix use-after-free of inrange_timer on remove

uclogic_remove() cancels the pen in-range timer and then stops the

device:

timer_delete_sync(&drvdata->inrange_timer);

hid_hw_stop(hdev);

timer_delete_sync() only guarantees the timer is idle at that instant.

uclogic_raw_event_pen() keeps delivering pen reports until hid_hw_stop()

stops the transport several lines later, and every report with

pen->inrange == UCLOGIC_PARAMS_PEN_INRANGE_NONE re-arms the timer:

mod_timer(&drvdata->inrange_timer, jiffies + msecs_to_jiffies(100));

A report landing between the timer_delete_sync() call and the transport

teardown in hid_hw_stop() re-arms inrange_timer after it was cancelled.

uclogic_remove() then returns and the devm drvdata is freed, while

hid_hw_stop() has already freed the input device drvdata->pen_input

points at, so when the timer fires ~100 ms later

uclogic_inrange_timeout() dereferences freed memory --

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References