CVE-2026-90329: HID: synchronize input before cleaning up a failed probe
HID: synchronize input before cleaning up a failed probe
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
A HID device probe must start I/O so that reports can be processed, and the probe must then fail. A report callback must run concurrently with the failed-probe cleanup and access resources, such as a hidraw object, that the cleanup path has freed.
Which systems are realistically exposed?
Linux systems using affected HID device handling are exposed when a HID device can reach this failed-probe race. The provided information does not identify specific kernel versions, HID devices, or configurations.
What does the fix change?
The fix stops input before failed-probe cleanup. It reacquires driver_input_lock and waits for report callbacks already in progress before driver resources are released and the driver pointer is cleared.