CVE-2026-80559

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: sur40 - fix input device registration ordering

In sur40_probe(), input_register_device() was previously called early before

the V4L2 video device and vb2_queue components were fully initialized. If

userspace opened the input device immediately upon registration, sur40_open()

would trigger and start the sur40_poll() worker thread. This worker thread

invokes sur40_process_video() and accesses the uninitialized vb2_queue

structure, leading to a data race and potential system crash.

Furthermore, if V4L2 or video registration failed after input_register_device()

succeeded, the error path fell through to calling input_free_device() on a

successfully registered device instead of input_unregister_device(), corrupting

input core state.

Move input_register_device() to the very end of sur40_probe(). This ensures

the V4L2 and video queue structures are fully initialized before polling can

start, and naturally resolves t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References