CVE-2026-98500

Received Received - Intake

Use cancel_delayed_work_sync() in HID oxp driver remove

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use cancel_delayed_work_sync() in remove oxp_hid_remove() uses cancel_delayed_work() for all three delayed work items. cancel_delayed_work() only dequeues a pending work item without waiting for a currently executing callback to finish. If any of the work callbacks (oxp_rgb_queue_fn, oxp_btn_queue_fn, oxp_mcu_init_fn) is running at the time of removal, the callback continues executing concurrently with hid_hw_close() and hid_hw_stop(), accessing the HID device after it has been closed and stopped. Use cancel_delayed_work_sync() instead to ensure that any in-progress work callback completes before device teardown proceeds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98500

EUVD

EUVD-2026-103740

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	84910c459d65ab3a1aeac7f936169fb71334dd46
Linux	Linux	84910c459d65ab3a1aeac7f936169fb71334dd46
Linux	Linux	7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's HID subsystem, specifically in the hid-oxp driver. It involves a race condition where delayed work items are not properly synchronized during device removal. The issue occurs because cancel_delayed_work() is used instead of cancel_delayed_work_sync(), which can lead to work callbacks executing after the device is closed and stopped.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID subsystem and cannot be detected via network scanning or typical system commands. It requires checking the kernel version and verifying if the affected code is present in the running kernel. Inspect the kernel logs for errors related to HID device removal or concurrent work callbacks.

Impact Analysis

This vulnerability could cause system instability or crashes when a HID device using the hid-oxp driver is removed. It may lead to memory corruption, use-after-free errors, or other undefined behavior due to concurrent access to a closed device.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a race condition in the Linux kernel's HID subsystem that could lead to memory corruption or undefined behavior during device removal. Compliance impacts would only occur if this vulnerability were exploited to compromise data integrity or availability in systems handling sensitive data.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If an update is not immediately available, avoid removing HID devices while they are in use to prevent potential race conditions. Monitor kernel logs for related errors.

Hi! I’m here to help you understand CVE-2026-98500. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70