CVE-2026-89625: HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
HID: sony: fix UAF of ghlpoketimer / ghlurb at driver unbind
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.50 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In sony_remove(), call usb_poison_urb(sc->ghl_urb) before timer_shutdown_sync(&sc->ghl_poke_timer), then call usb_free_urb(sc->ghl_urb); this permanently rejects further URB submissions, prevents timer re-arming, and safely releases the URB.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel HID Sony driver with a Guitar Hero Live dongle are exposed. The affected path is specific to GHL dongles, which use the periodic poke timer and associated USB request.
What event is required to trigger the use-after-free?
The issue requires a race between driver unbind, such as device disconnect or module removal, and completion of an in-flight USB request. The completion can re-arm the timer after removal has attempted to delete it, allowing the timer to run after its containing driver state has been freed.
What mitigation is available if an updated kernel cannot be deployed immediately?
Avoid disconnecting the Guitar Hero Live dongle or removing the relevant driver while the dongle is in use. This reduces exposure to the described disconnect/rmmod race, though the data does not provide a complete workaround.
How does the fix prevent the race?
The fix poisons the USB request before shutting down the timer and freeing the request. Poisoning kills in-flight requests and permanently rejects further submissions, preventing a completion handler from re-arming the timer during driver removal.