Executive brief
The Linux kernel's HID (Human Interface Device) subsystem contains a race condition in its BPF (Berkeley Packet Filter) interface that can cause the kernel to use memory that has already been freed. An attacker with the ability to trigger device destruction and BPF link release operations concurrently could crash the system or potentially execute code with kernel privileges.
Technical details
This is a use-after-free vulnerability in the HID BPF struct_ops destroy path caused by a race condition between __hid_bpf_ops_destroy_device() and hid_bpf_unreg(). Both paths attempt to release the same device reference without proper synchronization. The vulnerability occurs because the TOCTOU (time-of-check-time-of-use) check on ops->hdev operates under different lock domains (rcu_read_lock vs prog_list_lock), allowing both paths to execute concurrently and decrement the reference count twice. The fix serializes the remove/NULL decision under prog_list_lock on both sides and moves destroy-side puts outside the lock. This vulnerability is reachable from user-space through BPF map delete operations and HID device destruction, though it requires specific timing and BPF capabilities.
Affected products
- Linux Linux kernel
Timeline
- 2026-09-16: disclosed