CVE-2026-80559: Add CVSS 3.1 score (7.8 HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AV:L - Exploitation is via open() on /dev/input/eventX (evdev ->
    input_open_device -> sur40_open -> sur40_poll ->
    sur40_process_video) racing sur40_probe() before vb2_queue_init();
    on permanently installed PixelSense/SUR40 kiosk tables no physical
    USB access is needed at attack time.
AC:L - The attacker controls both sides of the race by monitoring
    udev/inotify for the new input node and immediately opening it
    during USB hotplug or reboot probe; polling starts synchronously in
    input_dev_poller_start, making the uninitialized vb2_queue access
    reliably triggerable without uncontrollable kernel preconditions.
PR:L - Triggering sur40_open requires only local userspace access to the
    evdev node (typically membership in the input group or equivalent
    kiosk-app privileges opening /dev/input/event*), not real root in
    the init namespace; user namespaces cannot substitute for this
    device access.
UI:N - No victim interaction is required beyond the attacker's own
    actions; they can open the input device themselves (or rely on an
    auto-opening compositor during reconnect) and time the race during
    probe without needing another user to touch the screen or perform
    any action.
S:U - Impact is confined to kernel memory corruption and crashes within
    the host input/USB driver context on the same system; it does not
    cross VM, container, or IOMMU security boundaries despite potential
    local privilege escalation as a follow-on.
C:H - Concurrent access to a partially initialized vb2_queue is a kernel
    data race that can read uninitialized queue state, and the probe
    error path calls input_free_device() on a registered device,
    corrupting input-core linked lists—both are memory-corruption
    primitives leverageable for kernel information disclosure.
I:H - The input_free_device() misuse corrupts global input-core list
    state (definite kernel structure corruption), and racing poll
    against vb2_queue_init can invoke vb2_buffer_done and list
    operations on uninitialized queue internals, enabling exploitable
    heap/control-structure writes.
A:H - The fix commit explicitly cites a data race on the uninitialized
    vb2_queue leading to system crash; corrupting input-core
    registration state or racing teardown during USB disconnect can
    cause kernel oops/panic and deny service on interactive
    SUR40/PixelSense deployments.

Signed-off-by: Sasha Levin <sashal@kernel.org>