CVE-2026-89626: HID: sensor: custom: Fix field sysfs group cleanup on failure
In the Linux kernel, the following vulnerability has been resolved:
HID: sensor: custom: Fix field sysfs group cleanup on failure
hidsensorcustomaddattributes() creates one sysfs group for each custom sensor field. If sysfscreategroup() fails after some groups have already been created, the function returns the error without removing the previously created groups.
Add a local unwind path to remove the groups that were already created. With enablesensor exposed only after the field attributes are ready, this path can free sensorinst->fields without leaving enablesensor able to access pointers into that array.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a local unwind path so that when hid_sensor_custom_add_attributes() hits an error after sysfs_create_group() fails partway through, it removes the previously created sysfs groups to avoid leaving stale state (free sensor_inst->fields without leaving enable_sensor accessible).
Linux kernel (hid sensor: custom) local unwind path for sysfs groups on failure = implemented
Event History
Frequently Asked Questions
Under what condition can this issue occur?
It can occur when creation of a sysfs group for a custom sensor field fails after one or more earlier field sysfs groups have already been created.
What is the practical impact of the failed cleanup?
Previously created field sysfs groups can remain after the sensor field array is freed. The cleanup change ensures that enable_sensor is not left able to access pointers into that freed array.
How can exposure be reduced if the fix is not yet available?
The provided information identifies the affected path as custom HID sensor field sysfs attribute setup. No specific configuration workaround or detection method is provided.