CVE-2026-98500: HID: hid-oxp: use cancel_delayed_work_sync() in remove
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-oxp: use canceldelayedworksync() in remove
oxphidremove() uses canceldelayedwork() for all three delayed work items. canceldelayedwork() only dequeues a pending work item without waiting for a currently executing callback to finish. If any of the work callbacks (oxprgbqueuefn, oxpbtnqueuefn, oxpmcuinitfn) is running at the time of removal, the callback continues executing concurrently with hidhwclose() and hidhwstop(), accessing the HID device after it has been closed and stopped.
Use canceldelayedworksync() instead to ensure that any in-progress work callback completes before device teardown proceeds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace cancel_delayed_work() with cancel_delayed_work_sync() for the oxp_rgb_queue_fn, oxp_btn_queue_fn, and oxp_mcu_init_fn delayed work callbacks so in-progress callbacks finish before HID device teardown.
Linux kernel hid-oxp oxp_hid_remove() delayed work cancellation = cancel_delayed_work_sync()