CVE-2026-64595
Received Received - Intake

Use-after-Free in Linux Kernel HID Driver

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it to run 2 ms later: INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup); schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2)); cfg_setup() dereferences drvdata.hdev to issue MCU command requests. hid_go_cfg_remove() tears down sysfs and stops the HID device, but never drains the delayed work. If the device is unbound within the 2 ms scheduling delay (a probe failure rolling back via remove, or a fast rmmod after probe), the work fires after hid_destroy_device() has dropped its reference and released the underlying hdev struct, leaving cfg_setup() with a stale drvdata.hdev pointer. Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove() already calls cancel_delayed_work_sync() on its analogous work, and drain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel must come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup() acquires that mutex; reversing the order would deadlock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-64595
EUVD
EUVD-2026-53782

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lenovo hid-lenovo-go *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's hid-lenovo-go driver. The issue occurs when the device is unbound or removed shortly after probing. The driver schedules a delayed work item to run 2ms later but fails to cancel it during removal. If the work executes after the device is destroyed, it dereferences a freed pointer, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID driver for Lenovo devices. Detection requires checking kernel logs for hid-lenovo-go related errors or examining the driver's work queue handling. Inspect kernel logs for messages about delayed work or stale pointers using: dmesg | grep -i hid-lenovo-go or journalctl -k | grep -i hid-lenovo-go.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. Users might experience kernel panics, unexpected reboots, or denial-of-service conditions when using affected Lenovo HID devices.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-64595. If immediate patching is not possible, consider unloading the hid-lenovo-go module if not in use: modprobe -r hid-lenovo-go. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64595. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart