Executive brief
A vulnerability was identified in the Linux kernel's idmouse driver, which supports certain USB fingerprint sensors. A race condition occurs when a device is disconnected while being accessed, potentially leading to a system crash or memory corruption. This issue primarily affects systems where these specific USB devices are physically attached and removed.
Technical details
A use-after-free vulnerability exists in drivers/usb/misc/idmouse.c in the Linux kernel. The root cause is a race condition between the release() and disconnect() functions where mutex_unlock() may access a mutex structure after the underlying object's lifetime has ended. Because mutex_unlock() is non-atomic and may access the lock object after releasing it, it cannot safely manage object destruction. The fix introduces kref reference counting to ensure the driver data is only freed after all references, including those held during the unlock sequence, are released. This requires physical access to trigger a device disconnect race.
Affected products
- Linux Linux 2.6.24 to 6.10.x
Timeline
- 2026-06-22: patched: Initial patch authored by Johan Hovold
- 2026-07-25: disclosed: CVE published via kernel.org and NVD
References
- https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872
- https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb
- https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09
- https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41
- https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4
- https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515
- https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4