CVE-2026-64362: HID: lg-g15: cancel pending work on remove to fix a use-after-free
HID: lg-g15: cancel pending work on remove to fix a use-after-free
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Remove
Remove
linux kernel driver: lg-g15 (HID: lg-g15)from your environment.Add a remove callback that cancels pending work before devres frees lg_g15_data to fix a use-after-free on device unplug.
- Configuration
In the driver’s remove callback, cancel the scheduled work (e.g., via cancel on g15->work.func) to avoid cancelling a work item that was never set for models that do not initialize g15->work.
lg-g15 (HID: lg-g15) driver remove callback: cancel pending work = cancel pending work on remove (with a NULL/guard test matching the g15 NULL test in lg_g15_raw_event())
Event History
Frequently Asked Questions
Which devices and actions can trigger the vulnerable path?
The affected work item is used by the Logitech G15, G15 v2, and G510 HID driver paths. It can be scheduled by device input, including the backlight cycle key handling for G15 and G15 v2; the G510 LED event handler can also schedule it.
What must happen for exploitation to be possible?
An attacker needs local access and low privileges, and must win a race where the device schedules the work and is then unplugged while that work is pending or running. The worker can then dereference driver state after it has been freed.
Are all models handled by this driver affected?
No. The described uninitialized-work concern applies to G13 and Z-10, which do not set up the work item that is cancelled during removal. The use-after-free path described involves models that initialize and schedule that work: G15, G15 v2, and G510.
What is the remediation?
Apply a kernel update containing the remove callback that cancels pending work before device-managed driver state is freed. The referenced stable commits provide the fix.