CVE-2026-64595: HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove()
hidgocfgprobe() initialises drvdata.gocfgsetup and schedules it to run 2 ms later:
INITDELAYEDWORK(&drvdata.gocfgsetup, &cfgsetup); scheduledelayedwork(&drvdata.gocfgsetup, msecstojiffies(2));
cfgsetup() dereferences drvdata.hdev to issue MCU command requests. hidgocfgremove() tears down sysfs and stops the HID device, but never drains the delayed work. If the device is unbound within the 2 ms scheduling delay (a probe failure rolling back via remove, or a fast rmmod after probe), the work fires after hiddestroydevice() has dropped its reference and released the underlying hdev struct, leaving cfgsetup() with a stale drvdata.hdev pointer.
Mirror the sibling driver hid-lenovo-go-s.c, whose hidgoscfgremove() already calls canceldelayedworksync() on its analogous work, and drain gocfgsetup at the top of hidgocfgremove(). The cancel must come before guard(mutex)(&drvdata.cfgmutex) because cfgsetup() acquires that mutex; reversing the order would deadlock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In hid_go_cfg_remove(), drain the delayed work drvdata.go_cfg_setup immediately at the top of the function (before tearing down sysfs and stopping the HID device) to prevent cfg_setup() from running after hid_destroy_device() has dropped the hdev reference.
Linux kernel HID driver hid-lenovo-go delayed work draining/cancellation order = drain go_cfg_setup at the top of hid_go_cfg_remove() before other teardown
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64595?
CVE-2026-64595 has a risk score of 44, indicating a significant impact.
How do I fix CVE-2026-64595?
To resolve CVE-2026-64595, update the Linux kernel to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-64595?
CVE-2026-64595 affects systems running vulnerable versions of the Linux kernel with HID: hid-lenovo-go.
What type of vulnerability is CVE-2026-64595?
CVE-2026-64595 is a kernel vulnerability related to the handling of HID devices.
When was CVE-2026-64595 published?
CVE-2026-64595 was published on August 6, 2026.