Executive brief
The Linux kernel's HID sensor custom driver contains a use-after-free vulnerability in the enable_sensor sysfs attribute handler. A local attacker with access to sysfs can write to the enable_sensor attribute while the driver is being removed, causing the kernel to dereference freed memory and crash the system or potentially execute arbitrary code.
Technical details
The vulnerability is a use-after-free bug in the HID sensor custom driver (drivers/hid/hid-sensor-custom.c). The enable_sensor_store() function dereferences sensor_inst->power_state and sensor_inst->report_state pointers, which point to entries in sensor_inst->fields. During probe, the enable_sensor sysfs attribute was exposed before field attributes were initialized, and during removal, field attributes were freed before the enable_sensor sysfs attribute was deleted. This allowed a concurrent sysfs write to dereference freed memory. The fix reorders initialization to create field attributes before exposing enable_sensor, and reorders cleanup to delete enable_sensor before freeing field attributes. Local access to sysfs is required. A patch was committed upstream and backported to stable kernel versions.
Affected products
- Linux Linux kernel multiple stable versions (see kernel.org commit history)
Timeline
- 2026-09-04: disclosed: Published on NVD
- 2026-08-27: patched: Committed to stable kernel tree by Greg Kroah-Hartman