CVE-2026-90329: HID: synchronize input before cleaning up a failed probe
In the Linux kernel, the following vulnerability has been resolved:
HID: synchronize input before cleaning up a failed probe
hiddeviceiostart() allows reports to run concurrently with probe. If the probe subsequently fails, hiddeviceprobe() releases driver resources and clears hdev->driver without first excluding those report callbacks.
For example, a report may enter hidrawreportevent() while the failure path frees the associated hidraw object, leading to a use-after-free when the report takes the object's list lock.
Stop input before performing failed-probe cleanup. This reacquires driverinputlock and waits for any report callback already in progress.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
A HID device probe must start I/O so that reports can be processed, and the probe must then fail. A report callback must run concurrently with the failed-probe cleanup and access resources, such as a hidraw object, that the cleanup path has freed.
Which systems are realistically exposed?
Linux systems using affected HID device handling are exposed when a HID device can reach this failed-probe race. The provided information does not identify specific kernel versions, HID devices, or configurations.
What does the fix change?
The fix stops input before failed-probe cleanup. It reacquires driver_input_lock and waits for report callbacks already in progress before driver resources are released and the driver pointer is cleared.