Linux Kernel EUVD-2026-66474

Exploitation requires all of the following: (1) a Samsung SUR40 multi-touch table physically connected to the target system, causing the sur40 kernel module to load and sur40_probe() to execute; (2) a local user account with at least standard (non-root) privileges sufficient to open input device nodes under /dev/input/ (PR:L per CVSS); (3) a race window during driver probe - specifically the gap between input_register_device() returning and vb2_queue_init() completing. Systems without SUR40 hardware are entirely unaffected; the sur40 module does not load. Remote exploitation is impossible (AV:L). Root or administrator privileges are not required for the race trigger, but the device node permissions on the specific distribution may further limit which local users have read access to /dev/input/event* nodes. The race window is narrow but reproducible on affected hardware.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects kernel-level impact but overstates practical risk for most environments due to the strict hardware prerequisite. Exploitation requires a Samsung SUR40 physical device connected to the system, limiting the exposed population to kiosk, interactive display, or specialized research installations - not general-purpose servers or cloud infrastructure. The CVSS AC:L rating is generous; the underlying bug is a race condition triggered during a narrow probe window, which in practice may be closer to AC:H. KEV status is not listed, confirming no known active exploitation at time of analysis. No EPSS data was provided; given the niche hardware requirement and absence of public exploit code, exploitation probability is assessed as low. The 'Denial Of Service' tag from EUVD aligns with the primary crash impact; kernel memory corruption could theoretically enable privilege escalation (explaining C:H/I:H) but no exploit demonstrating this has been reported. The secondary error-path bug (input_free_device misuse) is a reliability defect more than a primary exploit primitive. Overall: patch on affected hardware at normal cadence; this does not warrant emergency response outside environments actually running SUR40 devices.

A local user on a kiosk or interactive table system with an attached Samsung SUR40 device writes a tight loop that opens the input event node (e.g., /dev/input/event3) as soon as the device is enumerated - for example, triggered by a udev rule race or a hotplug event. The open call arrives during the narrow window after input_register_device() completes but before vb2_queue_init() returns, causing sur40_open() to schedule the sur40_poll worker, which calls sur40_process_video() and dereferences fields in the uninitialized vb2_queue structure, resulting in a kernel oops or general protection fault and system crash. No public exploit code is known at time of analysis.