CVE-2026-89625: HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
HID: sony: fix UAF of ghlpoketimer / ghlurb at driver unbind
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind - Compensating control
For the affected HID sony driver (GHL Guitar Hero Live dongles emulation), avoid performing disconnect/rmmod operations concurrently with device activity; ensure the driver is fully unbound/drained before removing the module or device to prevent the disconnect/rmmod race where the poke timer can re-arm after unbind.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel HID Sony driver with a Guitar Hero Live dongle are exposed. The affected path is specific to GHL dongles, which use the periodic poke timer and associated USB request.
What event is required to trigger the use-after-free?
The issue requires a race between driver unbind, such as device disconnect or module removal, and completion of an in-flight USB request. The completion can re-arm the timer after removal has attempted to delete it, allowing the timer to run after its containing driver state has been freed.
What mitigation is available if an updated kernel cannot be deployed immediately?
Avoid disconnecting the Guitar Hero Live dongle or removing the relevant driver while the dongle is in use. This reduces exposure to the described disconnect/rmmod race, though the data does not provide a complete workaround.
How does the fix prevent the race?
The fix poisons the USB request before shutting down the timer and freeing the request. Poisoning kills in-flight requests and permanently rejects further submissions, preventing a completion handler from re-arming the timer during driver removal.