CVE-2026-64362: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64362 Overview

CVE-2026-64362 is a use-after-free vulnerability in the Linux kernel's HID: lg-g15 driver, which supports Logitech G15, G15 v2, and G510 gaming keyboards. The driver allocates lg_g15_data through the device-managed (devm) allocator and schedules a work item from report handlers such as lg_g15_event(), lg_g15_v2_event(), and lg_g510_leds_event(). Because the driver lacked a remove callback and never cancelled the pending work, unplugging the keyboard while the worker was still scheduled or running caused devres to free lg_g15_data while the worker was still dereferencing it via container_of. The result is a kernel use-after-free reachable as a race on device disconnect.

Critical Impact
A race condition on USB unplug allows the kernel worker to access freed memory, potentially leading to kernel memory corruption or local privilege escalation for users with physical access to affected Logitech keyboards.

Affected Products

Linux kernel HID: lg-g15 driver (Logitech G15 keyboard support)
Logitech G15, G15 v2, and G510 keyboards handled by the affected driver
Multiple stable kernel branches referenced in the fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64362 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64362

Vulnerability Analysis

The lg-g15 HID driver manages state for Logitech gaming keyboards through a lg_g15_data structure allocated with the device-managed allocator. This structure embeds a struct work_struct that report handlers schedule from device input paths. The worker function recovers the parent lg_g15_data pointer through container_of on the embedded work item.

Devres cleans up device-managed allocations when the underlying device is removed. The driver did not register a remove callback and did not call cancel_work_sync() on the embedded work item during teardown. If a HID report scheduled the work moments before the user unplugged the keyboard, devres freed lg_g15_data while the worker was still queued or executing. The worker then dereferenced freed heap memory when computing offsets through container_of, satisfying the classic definition of a use-after-free [CWE-416].

Root Cause

The root cause is missing lifetime coordination between a devm-allocated state object and a work item stored inside it. Devm frees the object at device removal, but the driver never guaranteed that the work item was quiesced before that free occurred. The window between scheduling and execution can therefore outlive the containing allocation.

Attack Vector

The attack vector is local and requires the ability to trigger device removal while a report handler has recently queued work. On the G15, G15 v2, and G510 models, pressing the backlight cycle key schedules the worker; disconnecting the USB device immediately after generating such a report races the worker against devres cleanup. The G13 and Z-10 models do not initialize the work item and are not part of the racing path, but the fix must guard cancel_work_sync() on those models by testing g15->work.func before cancelling.

The upstream fix adds a remove callback that cancels the pending work before devres frees driver state. See the kernel commits 33cd1a0, 3b9a391, and 4aef967 for the backported patches across stable branches.

Detection Methods for CVE-2026-64362

Indicators of Compromise

Kernel oops or general protection fault referencing the lg-g15 module or a worker function inside it, especially shortly after a USB disconnect event
KASAN reports flagging use-after-free reads in the lg_g15 worker path with a freed lg_g15_data allocation
Repeated attach and detach sequences for a Logitech G15, G15 v2, or G510 vendor/product ID in dmesg or journalctl -k output

Detection Strategies

Enable KASAN on test kernels to catch use-after-free accesses in HID driver workers during device removal fuzzing
Correlate USB unplug events with kernel panics or oops entries in system logs to identify race-driven crashes
Inventory hosts loading the hid_lg_g15 module and confirm they run a patched kernel build

Monitoring Recommendations

Ship kernel logs to a centralized SIEM and alert on BUG:, KASAN, or Oops entries containing lg_g15 or hid-lg-g15
Monitor for unexpected loading of hid_lg_g15 on servers or workstations that do not need Logitech gaming keyboard support
Track USB device connect and disconnect telemetry on sensitive endpoints to spot abnormal reconnection patterns

How to Mitigate CVE-2026-64362

Immediate Actions Required

Update to a Linux kernel version that includes the HID: lg-g15 remove callback patch across the affected stable branches
Restrict physical access to systems that use affected Logitech G15, G15 v2, or G510 keyboards until patches are applied
If patching is not immediately feasible, blacklist the hid_lg_g15 module on hosts that do not require the driver

Patch Information

The fix adds a remove callback that calls cancel_work_sync() on g15->work before devres releases lg_g15_data. A NULL check on g15 mirrors the guard already present in lg_g15_raw_event(), and the cancel is gated on g15->work.func so models like the G13 and Z-10 that never initialize the work item are handled safely. Backports are available in commits 4d0d51b, 7705b41, 8131f42, acce9de, and dfc6e61.

Workarounds

Blacklist the driver by adding blacklist hid_lg_g15 to /etc/modprobe.d/blacklist-lg-g15.conf and rebuilding the initramfs
Physically disconnect affected Logitech keyboards from systems that cannot be patched immediately
Enforce endpoint controls that prevent unauthorized USB device hot-plug on sensitive hosts

bash

# Blacklist the affected HID driver until the kernel is patched
echo 'blacklist hid_lg_g15' | sudo tee /etc/modprobe.d/blacklist-lg-g15.conf
sudo modprobe -r hid_lg_g15
sudo update-initramfs -u