CVE-2026-90331: HID: asus: refactor the two workqueues and init sequence
In the Linux kernel, the following vulnerability has been resolved:
HID: asus: refactor the two workqueues and init sequence
Multiple issues have been found within the hid-asus driver: - unchecked size in asusrawevent() - unclean teardown of asusprobe on failure - possible use-after-free in asusprobe - multiple workqueue used for jobs where one was enough - sleeping calls in atomic context - packets of incorrect size being sent to the keyboard controller
Join the two workqueues into one reusing the stopping mechanism of the brightness workqueue, use the joined workqueue to also move the asuswmisendevent() sleeping call away from atomic context and add a size check in asusrawevent().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the hid-asus driver so asus_raw_event() validates the packet size before use to prevent unchecked size handling.
hid-asus driver (Linux kernel) asus_raw_event() input size checking = add size check - Configuration
Modify hid-asus so the asus_wmi_send_event() sleeping call is executed outside of atomic context (e.g., not from the brightness workqueue context), by using the joined workqueue.
hid-asus driver (Linux kernel) asus_wmi_send_event() call context = move sleeping call away from atomic context - Configuration
Refactor hid-asus work handling so the two workqueues are joined into one, reusing the stopping mechanism, to address the reported multi-workqueue issue.
hid-asus driver (Linux kernel) workqueue design = join the two workqueues into one - Compensating control
Ensure a clean teardown of asus_probe on failure paths (per the fix) to reduce risk from possible unclean teardown leading to use-after-free.