CVE-2026-64595: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64595 Overview

CVE-2026-64595 is a use-after-free vulnerability in the Linux kernel's hid-lenovo-go HID driver. The hid_go_cfg_probe() function schedules a delayed work item (cfg_setup) to run 2 ms after probe. The corresponding hid_go_cfg_remove() function tears down sysfs and stops the HID device but never drains the delayed work. If the device unbinds within the 2 ms scheduling window, the work fires after hid_destroy_device() releases the underlying hdev struct. This leaves cfg_setup() operating on a stale drvdata.hdev pointer.

Critical Impact
Local unbind or fast rmmod after probe can trigger a use-after-free on drvdata.hdev, potentially causing kernel memory corruption or a crash.

Affected Products

Linux kernel versions containing the hid-lenovo-go driver prior to the fix
Stable kernel branches referenced by commits 3e7761f and 73fde0c
Systems using Lenovo Go HID peripherals bound to the affected driver

Discovery Timeline

2026-08-06 - CVE-2026-64595 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64595

Vulnerability Analysis

The defect lives in the lifecycle handling of a delayed_work structure inside the hid-lenovo-go driver. During probe, the driver initializes and schedules the work item with a 2 ms delay:

INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup); followed by schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2));.

The scheduled cfg_setup() handler dereferences drvdata.hdev to issue microcontroller command requests. The remove path calls hid_destroy_device() and releases the last reference to hdev, but does not synchronously cancel the pending work. When the unbind race occurs, the work fires against freed memory.

Root Cause

The root cause is a missing cancel_delayed_work_sync() call in hid_go_cfg_remove(). The sibling driver hid-lenovo-go-s.c already drains its analogous work in hid_gos_cfg_remove(). Ordering matters: the cancel must occur before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup() acquires that same mutex, and reversing the order would deadlock.

Attack Vector

Exploitation requires local access to trigger driver unbind or a rapid rmmod sequence following probe, or a probe failure that rolls back through the remove path. An attacker with the ability to bind and unbind USB or HID devices, or to load and unload the module, can race the 2 ms scheduling delay to reach the freed hdev structure.

No verified public exploit code is available. Refer to the upstream commits Kernel Git Commit 3e7761f and Kernel Git Commit 73fde0c for the fix details.

Detection Methods for CVE-2026-64595

Indicators of Compromise

Kernel oops or general protection fault traces referencing cfg_setup or hid_go_cfg symbols
KASAN use-after-free reports naming drvdata.hdev or hid_device slabs shortly after HID device unbind events
Unexpected kernel panics correlated with USB/HID device removal or rmmod hid_lenovo_go

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface use-after-free access during device bind/unbind fuzzing
Monitor dmesg for stack traces containing hid_go_cfg_remove, hid_destroy_device, and delayed-work callbacks
Track kernel version and loaded module inventory to identify hosts still running the unpatched hid-lenovo-go driver

Monitoring Recommendations

Alert on repeated USB HID bind/unbind cycles on endpoints with Lenovo Go peripherals
Collect and centralize kernel crash dumps to identify recurring faults in the HID subsystem
Track module load/unload events (init_module, delete_module) via audit rules for the hid_lenovo_go module

How to Mitigate CVE-2026-64595

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 3e7761f7bf9f and 73fde0cbff7d to all affected systems
Rebuild and redeploy any downstream or distribution kernels that carry the hid-lenovo-go driver
Prioritize patching on multi-user hosts and systems where untrusted users can trigger device unbind

Patch Information

The fix adds a cancel_delayed_work_sync(&drvdata.go_cfg_setup) call at the top of hid_go_cfg_remove(), before acquiring drvdata.cfg_mutex. This drains any pending cfg_setup work before hid_destroy_device() releases the underlying hdev reference, eliminating the use-after-free window. See Kernel Git Commit 3e7761f and Kernel Git Commit 73fde0c.

Workarounds

Blacklist the hid_lenovo_go module on systems that do not require Lenovo Go peripheral support
Restrict physical and administrative access that would permit rapid device bind/unbind or module unload
Disable automatic module unloading in environments where the driver must remain loaded

bash

# Configuration example: blacklist the vulnerable module until patched
echo "blacklist hid_lenovo_go" | sudo tee /etc/modprobe.d/blacklist-hid-lenovo-go.conf
sudo depmod -a
sudo update-initramfs -u