CVE-2026-80767: HID: sensor: custom: Fix use-after-free in enable_sensor
In the Linux kernel, the following vulnerability has been resolved:
HID: sensor: custom: Fix use-after-free in enablesensor
enablesensorstore() can call setpowerreportstate(), which dereferences sensorinst->powerstate and sensorinst->reportstate. These pointers refer to entries in sensorinst->fields.
Create the field attributes before exposing the enablesensor sysfs attribute, so enablesensor cannot be accessed before the state it depends on has been initialized.
On remove, delete enablesensor before freeing the field attributes, so a concurrent sysfs write cannot dereference freed memory through powerstate or reportstate.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel HID sensor custom driver are exposed when its enable_sensor sysfs attribute is available. The issue concerns access to that sysfs control during driver initialization or removal.
What does an attacker or local user need to do to trigger it?
A local actor needs the ability to write the enable_sensor sysfs attribute at the same time the driver is being initialized or removed. The vulnerable path can dereference power_state or report_state before they are initialized or after their backing field attributes have been freed.
How can I tell whether a system may already be affected?
Review whether the running kernel includes the referenced fixes and whether the HID sensor custom driver is in use. The described failure condition involves concurrent writes to enable_sensor during probe or device removal.
What mitigation is available if patching cannot be applied immediately?
Restrict access to the enable_sensor sysfs attribute so untrusted local users cannot write it. Avoid writing that attribute while the affected HID sensor device or driver is being initialized or removed.