CVE-2026-89625: Linux Kernel HID Sony Use-After-Free Vulnerability

CVE-2026-89625 Overview

CVE-2026-89625 is a use-after-free vulnerability in the Linux kernel hid-sony driver. The flaw affects handling of Guitar Hero Live (GHL) dongles during driver unbind. The sony_probe() function arms a periodic timer (ghl_poke_timer) that submits a URB, and the URB completion callback re-arms the timer via mod_timer(). The sony_remove() cleanup path used timer_delete_sync() followed by usb_free_urb(), which fails to prevent an in-flight URB completion from re-arming the timer against freed memory. The result is a use-after-free in timer softirq context on the freed sony_sc structure allocated with devm_kzalloc().

Critical Impact
An attacker able to trigger a driver disconnect/rmmod race against a bound GHL dongle can cause kernel memory corruption from timer softirq, leading to denial of service or potential local privilege escalation.

Affected Products

Linux kernel hid-sony driver (GHL dongle code path)
Systems binding Guitar Hero Live PS4 dongles (VID 0x1430 / PID 0x07bb)
Kernel versions prior to the commits referenced in stable trees 114a5864, 3155dc32, and a26705bd

Discovery Timeline

2026-09-11 - CVE-2026-89625 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89625

Vulnerability Analysis

The vulnerability is a [CWE-416] use-after-free triggered by a race between USB disconnect and a self-rearming timer. During sony_probe(), the driver allocates the sony_sc context via devm_kzalloc() and arms ghl_poke_timer. The timer callback ghl_magic_poke() submits sc->ghl_urb, and its completion handler ghl_magic_poke_cb() re-arms the timer with mod_timer().

The original cleanup sequence in sony_remove() called timer_delete_sync(&sc->ghl_poke_timer) followed by usb_free_urb(sc->ghl_urb). Because timer_delete_sync() does not block future re-arming, and because the timer is not pending while its URB is in flight, the sync delete becomes a no-op. When the URB completion runs afterward, it re-arms the timer. usb_free_urb() only drops a reference and does not cancel an in-flight URB. Once sony_remove() returns, the devres-managed sc is freed, and the re-armed timer later fires against freed memory.

Root Cause

The root cause is incorrect teardown ordering in sony_remove() for the GHL code path. The driver treated timer_delete_sync() as sufficient to quiesce a timer that reschedules itself from a URB completion callback. Combined with devm_kzalloc() freeing sc immediately after sony_remove() returns, this creates a window where a live callback references freed memory.

Attack Vector

The attack requires local access to trigger a disconnect/rmmod race against a bound GHL dongle. The upstream report reproduced the flaw under KASAN on next-20260710 using dummy_hcd and raw-gadget to emulate the GHL PS4 dongle. hid-sony binds the emulated device, the poke URB is held in flight, the driver is unbound, and the re-armed timer fires roughly eight seconds later on the freed sony_sc structure. KASAN reports slab-use-after-free in ghl_magic_poke+0x98/0xb0 from call_timer_fn in the run_timer_softirq path.

The upstream fix inverts the shutdown order: call usb_poison_urb() first to kill any in-flight URB and permanently reject further submissions, then call timer_shutdown_sync() to drain any last callback and block future re-arming, then free the URB. usb_kill_urb() alone would be insufficient because the URB remains submittable after it returns. See the kernel commit reference for the applied patch.

Detection Methods for CVE-2026-89625

Indicators of Compromise

KASAN reports containing slab-use-after-free in ghl_magic_poke originating from call_timer_fn and run_timer_softirq
Kernel oops or panic traces referencing ghl_magic_poke_cb after a hid-sony unbind event
Unexpected hid-sony module unload events immediately followed by softirq stack corruption within seconds

Detection Strategies

Enable KASAN on test kernels and exercise USB disconnect flows for HID devices matching VID 0x1430 / PID 0x07bb
Monitor dmesg for BUG: KASAN messages tied to the hid-sony code path
Audit installed kernel versions against the fixed stable commits 114a58640aaf, 3155dc327344, and a26705bd2e27

Monitoring Recommendations

Alert on repeated hid-sony bind/unbind cycles on production hosts, which is atypical outside development environments
Collect kernel ring buffer output centrally to catch softirq faults following device removal
Track kernel package versions across Linux fleets to identify unpatched hosts

How to Mitigate CVE-2026-89625

Immediate Actions Required

Apply the upstream kernel patch that reorders sony_remove() to poison the URB before shutting down the timer
Update to a distribution kernel that includes the fixed commits from the stable tree
Restrict physical and virtual USB access on multi-tenant or shared systems where untrusted users can attach devices

Patch Information

The fix is applied across stable branches in commits 114a58640aaf, 3155dc327344, and a26705bd2e27. The patch replaces the vulnerable teardown sequence with usb_poison_urb() followed by timer_shutdown_sync() and then usb_free_urb().

Workarounds

Blacklist the hid-sony module on systems that do not require Sony HID device support
Disable USB raw-gadget and dummy_hcd interfaces on production hosts to reduce local reproduction surface
Enforce USB device allow-lists via udev rules to block unauthorized HID dongles from binding

bash

# Blacklist hid-sony where not required
echo 'blacklist hid-sony' | sudo tee /etc/modprobe.d/blacklist-hid-sony.conf
sudo update-initramfs -u

# Verify installed kernel includes the fix
dmesg | grep -i 'hid-sony'
uname -r