CVE-2026-80767: Linux Kernel HID Sensor Use-After-Free

CVE-2026-80767 Overview

CVE-2026-80767 is a use-after-free vulnerability in the Linux kernel's HID sensor custom driver. The flaw resides in the enable_sensor_store() sysfs handler, which calls set_power_report_state() and dereferences sensor_inst->power_state and sensor_inst->report_state. These pointers reference entries in sensor_inst->fields. The vulnerability allows access to the enable_sensor sysfs attribute before dependent field state is initialized, or after that state has been freed during device removal.

Critical Impact
A local attacker or concurrent sysfs writer can trigger a use-after-free condition in the HID sensor custom driver, potentially leading to kernel memory corruption or denial of service.

Affected Products

Linux kernel HID sensor custom driver (drivers/hid/hid-sensor-custom.c)
Multiple stable kernel branches patched via nine upstream commits
Systems using HID sensor hubs exposing custom sensor sysfs attributes

Discovery Timeline

2026-09-04 - CVE CVE-2026-80767 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80767

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the hid-sensor-custom driver. When enable_sensor_store() is invoked through the enable_sensor sysfs attribute, it calls set_power_report_state(), which dereferences power_state and report_state pointers held in sensor_inst. These pointers reference field entries that must be initialized before use and must not be freed while the sysfs attribute remains exposed.

The driver previously exposed the enable_sensor sysfs attribute before creating the field attributes on which it depends. This ordering allowed a user-space writer to reach set_power_report_state() before power_state and report_state were initialized. On device removal, the driver freed the field attributes before removing the enable_sensor attribute, permitting a concurrent sysfs write to dereference freed memory.

Root Cause

The root cause is incorrect initialization and teardown ordering between the enable_sensor sysfs attribute and the underlying field attributes. The driver did not enforce the invariant that sensor_inst->power_state and sensor_inst->report_state remain valid for the entire lifetime of the enable_sensor sysfs entry point.

Attack Vector

Exploitation requires local access to the target system with permission to write to the affected sysfs attribute. An attacker with the ability to open and write to the enable_sensor node during a narrow race window at bind or unbind time can trigger the use-after-free. Successful triggering can corrupt kernel memory or cause a kernel crash. See the upstream commits linked in the references for the exact patched code paths.

Detection Methods for CVE-2026-80767

Indicators of Compromise

Kernel oops or panic messages referencing hid-sensor-custom, enable_sensor_store, or set_power_report_state in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free reads on structures allocated inside sensor_inst->fields
Unexpected sysfs write activity targeting HID sensor enable_sensor nodes during device bind or unbind events

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to catch use-after-free access within the HID sensor custom driver code paths
Monitor kernel ring buffer telemetry for stack traces containing enable_sensor_store alongside HID sensor hub device removal events
Audit local processes writing to /sys/bus/platform/devices/*/HID-SENSOR-*/enable_sensor outside expected sensor management workflows

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on panic or use-after-free strings tied to HID drivers
Track loaded kernel module versions across the fleet to identify hosts still running unpatched hid-sensor-custom
Correlate sysfs write events with device hotplug or driver rebind operations to surface race-condition attempts

How to Mitigate CVE-2026-80767

Immediate Actions Required

Apply the patched Linux kernel from your distribution vendor as soon as updated packages are available
Restrict local user access on systems exposing HID sensor hub devices, since exploitation requires local sysfs write permissions
Unload the hid-sensor-custom module on systems where the driver is not required for hardware functionality

Patch Information

The fix reorders driver initialization and teardown: field attributes are created before the enable_sensor sysfs attribute is exposed, and enable_sensor is removed before the field attributes are freed. This closes both the pre-initialization and post-free race windows. Patches are available in the upstream commits: 244a1cb, 2ce90cf, 7bb79a3, 8406d4b, ad8fb82, c0757f1, c2be74b, d37ff4e, and d7cbea1d.

Workarounds

Blacklist the hid-sensor-custom module on hosts that do not require HID sensor hub functionality
Tighten sysfs permissions and udev rules to prevent unprivileged users from writing to enable_sensor attributes
Limit local shell access to trusted administrators on systems where the module cannot be removed

bash

# Blacklist the vulnerable module until patched kernels are deployed
echo "blacklist hid-sensor-custom" | sudo tee /etc/modprobe.d/blacklist-hid-sensor-custom.conf
sudo rmmod hid_sensor_custom 2>/dev/null || true
sudo update-initramfs -u