Executive brief
The Linux kernel's HID (Human Interface Device) subsystem has a race condition in device initialization that can lead to a use-after-free vulnerability. When a HID device probe fails, input callbacks may still be executing concurrently while the kernel frees associated resources, allowing an attacker with physical access to a malicious HID device to cause a system crash or potentially execute code.
Technical details
This is a use-after-free vulnerability in the HID subsystem's device probe path (hid-core.c). The root cause is that hid_device_io_start() permits report callbacks to execute concurrently with probe, but if probe fails, __hid_device_probe() releases driver resources and clears hdev->driver without first stopping input and waiting for in-flight callbacks. For example, a report callback in hidraw_report_event() may attempt to access a freed hidraw object's list lock, causing a use-after-free. The fix adds hid_device_io_stop() to the failure path to synchronize with any report callbacks already in progress. Attack vector is local/adjacent (physical HID device), no authentication required. Patch is available in upstream kernel and stable branches.
Affected products
- Linux Linux Kernel 2.6.11 through 6.12 and later (prior to patch)
Timeline
- 2026-09-17: disclosed
- 2026-08-03: patched: Patch 207853d46f7ef2e28042344a1468da8754c3ddbf by Yousef Alhouseen committed upstream