CVE-2026-90001: HID: bpf: serialize device reference release in struct_ops destroy path
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: serialize device reference release in structops destroy path
hidbpfopsdestroydevice() and hidbpfunreg() can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice() still uses it. Serialize the remove/NULL decision under hdev->bpf.proglistlock so exactly one path releases each registration reference: unreg re-checks ops->hdev under the lock and returns without putting when the destroy path already cleared it; all putdevice() calls happen after the lock is dropped, which is safe because a concurrent unreg then observes ops->hdev == NULL under the lock.
Background: each successful attach (hidbpfopsreg) acquires one device reference (hidgetdevice()). Two paths can release it:
- device destruction: hiddestroydevice() -> hidbpfdestroydevice() -> hidbpfopsdestroydevice(), which walks hdev->bpf.proglist under rcureadlock() and drops one reference per attached program; - BPF link release: bpf map delete (no BPFFLINK) synchronously calls stops->unreg() -> hidbpfunreg(), which drops the reference for its own registration.
The coordination handshake (e->hdev = NULL on the destroy side vs "if (!hdev) return" on the unreg side) is a TOCTOU check: the two paths run under different lock domains (rcureadlock vs proglistlock), so a concurrent unreg can read ops->hdev as non-NULL, block on proglistlock, and then proceed while the destroy traversal executes - both paths then drop the same reference. The refcount reaches zero legitimately (each decrement is individually valid), so no refcountt saturation fires: the device is simply freed while the transport is still inside hiddestroydevice(), and subsequent teardown touches freed memory.
The fix serializes the remove/NULL decision under proglistlock on both sides and moves the destroy-side puts outside the lock. With the lock held, plain reads/writes of ops->hdev are sufficient; no READONCE/WRITEONCE are added, keeping the patch minimal.
Unlocked-read safety: the unlocked read of ops->hdev at the top of hidbpfunreg() cannot touch a freed device, because the unreg path itself still holds this registration's reference (released only by its own hidputdevice() after the lock is dropped), and a destroy traversal that already cleared ops->hdev makes the lock-internal re-check return early without any put. At most one of the two paths releases each registration reference.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the race?
A HID BPF program must have been successfully attached, which gives it a device reference. The race occurs when device destruction and BPF link release through BPF map deletion without BPF_F_LINK concurrently release the same registration reference.
What is the likely impact of successful exploitation?
The same struct hid_device reference can be released twice, freeing the device while hid_destroy_device() is still using it. This is a use-after-free condition in the Linux kernel.
How can I tell whether an environment is exposed to this issue?
Exposure requires use of HID BPF attachments to HID devices and the possibility of concurrent HID device destruction and removal of the associated BPF registration. Systems not using successful HID BPF attachments do not have the described registration reference to race over.
What behavior does the fix introduce?
The fix serializes the decision to remove or clear the device reference under hdev->bpf.prog_list_lock. It ensures only one path releases each registration reference, while the actual put_device() call occurs after releasing the lock.