Executive brief
The Linux kernel's HID sensor custom driver contains a resource leak in its sysfs attribute initialization. If an error occurs while creating sysfs groups for sensor fields, previously created groups and memory are not properly cleaned up, leading to kernel memory and resource leaks that could degrade system stability over time.
Technical details
The vulnerability exists in the hid_sensor_custom_add_attributes() function in drivers/hid/hid-sensor-custom.c. When iterating through sensor fields to create sysfs groups, if sysfs_create_group() fails after some groups have already been created, the function returns the error without removing previously created groups or freeing the sensor_inst->fields memory allocation. This is a classic resource cleanup failure. The fix adds an error unwind path (err_remove_groups label) that iterates backward through created groups and calls sysfs_remove_group(), then frees the allocated memory. The vulnerability requires local access to trigger (sysfs attribute creation failure scenario) and can only be exploited by code with sufficient privilege to interact with the affected HID sensor subsystem.
Affected products
- Linux Linux kernel multiple versions before patch (affects 4.x through 7.x stable branches)
Timeline
- 2026-09-11: disclosed
- 2026-09-14: patched: Fix merged by Greg Kroah-Hartman in stable trees