)]}'
{
  "commit": "20a0edb35d21741e1c38c7ce058ad35ddcabd6c0",
  "tree": "9f166cd332e71378363b800c8ddfb67ae26d00ce",
  "parents": [
    "e55c3dc8669e282beb7055eafd4d413b2c74e9d2"
  ],
  "author": {
    "name": "Sasha Levin",
    "email": "sashal@kernel.org",
    "time": "Wed Aug 26 11:34:19 2026 -0400"
  },
  "committer": {
    "name": "Sasha Levin",
    "email": "sashal@kernel.org",
    "time": "Wed Aug 26 13:24:29 2026 -0400"
  },
  "message": "CVE-2026-80559: Add CVSS 3.1 score (7.8 HIGH)\n\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nAV:L - Exploitation is via open() on /dev/input/eventX (evdev -\u003e\n    input_open_device -\u003e sur40_open -\u003e sur40_poll -\u003e\n    sur40_process_video) racing sur40_probe() before vb2_queue_init();\n    on permanently installed PixelSense/SUR40 kiosk tables no physical\n    USB access is needed at attack time.\nAC:L - The attacker controls both sides of the race by monitoring\n    udev/inotify for the new input node and immediately opening it\n    during USB hotplug or reboot probe; polling starts synchronously in\n    input_dev_poller_start, making the uninitialized vb2_queue access\n    reliably triggerable without uncontrollable kernel preconditions.\nPR:L - Triggering sur40_open requires only local userspace access to the\n    evdev node (typically membership in the input group or equivalent\n    kiosk-app privileges opening /dev/input/event*), not real root in\n    the init namespace; user namespaces cannot substitute for this\n    device access.\nUI:N - No victim interaction is required beyond the attacker\u0027s own\n    actions; they can open the input device themselves (or rely on an\n    auto-opening compositor during reconnect) and time the race during\n    probe without needing another user to touch the screen or perform\n    any action.\nS:U - Impact is confined to kernel memory corruption and crashes within\n    the host input/USB driver context on the same system; it does not\n    cross VM, container, or IOMMU security boundaries despite potential\n    local privilege escalation as a follow-on.\nC:H - Concurrent access to a partially initialized vb2_queue is a kernel\n    data race that can read uninitialized queue state, and the probe\n    error path calls input_free_device() on a registered device,\n    corrupting input-core linked lists—both are memory-corruption\n    primitives leverageable for kernel information disclosure.\nI:H - The input_free_device() misuse corrupts global input-core list\n    state (definite kernel structure corruption), and racing poll\n    against vb2_queue_init can invoke vb2_buffer_done and list\n    operations on uninitialized queue internals, enabling exploitable\n    heap/control-structure writes.\nA:H - The fix commit explicitly cites a data race on the uninitialized\n    vb2_queue leading to system crash; corrupting input-core\n    registration state or racing teardown during USB disconnect can\n    cause kernel oops/panic and deny service on interactive\n    SUR40/PixelSense deployments.\n\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "745103f7d7ba00a01d62089d51f18f0ba8cf5ea8",
      "new_mode": 33188,
      "new_path": "cve/published/2026/CVE-2026-80559.cvss"
    }
  ]
}