Executive brief
The Linux kernel's hid-asus driver, which handles Asus HID keyboards and touchpads, contained multiple security and stability issues including unchecked input sizes, improper resource cleanup, potential use-after-free conditions, and sleeping operations in atomic contexts. These flaws could lead to system crashes, memory corruption, or denial of service on affected systems running vulnerable kernel versions.
Technical details
The vulnerability encompasses six distinct issues in the hid-asus driver: unchecked packet size in asus_raw_event() allowing buffer issues, unclean teardown in asus_probe() on failure paths, possible use-after-free in asus_probe(), redundant dual workqueues where one sufficed, sleeping calls (asus_wmi_send_event()) invoked from atomic context, and incorrect packet sizes sent to keyboard controller. The patch consolidates two workqueues into one, moves the WMI event call to non-atomic context, and adds size validation in raw event handling. The fix was merged into the Linux kernel mainline and backported to stable branches.
Affected products
- Linux Linux kernel affected versions in hid-asus driver; patched by commit 47669bec44fe12fe2c7adf2b299e980d7935a2ce
Timeline
- 2026-09-17: disclosed: CVE-2026-90331 published
- 2026-08-03: patched: Fix merged to mainline by Jiri Kosina
- 2026-09-14: patched: Backported to stable kernels by Greg Kroah-Hartman