Medium [CVE-2026-80572] byd - synchronize timer deletion before freeing private data

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait for a running byd_clear_touch() callback, which dereferences the private data and its psmouse pointer.

A callback racing with disconnect can therefore access the private data after it has been freed. The timer can also still be re-armed by byd_process_byte() while the disconnect is in progress.

Use timer_shutdown_sync() before freeing the private data: it waits for a running callback and turns any later re-arm attempt into a no-op. A race condition exists during device disconnection where the `byd_disconnect()` function frees private data before ensuring that a timer callback, `byd_clear_touch()`, has completed.

This can lead to the callback attempting to access memory after it has been freed, potentially resulting in system instability or denial of service. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-364. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.

Red Hat does not currently list a fixing RHSA for this CVE.

Affected products named by the advisory: Red Hat package: kernel-rt.