CVE-2026-89626: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89626 Overview

CVE-2026-89626 affects the Linux kernel's HID (Human Interface Device) sensor custom driver. The vulnerability exists in hid_sensor_custom_add_attributes(), which creates one sysfs group for each custom sensor field. When sysfs_create_group() fails after some groups have already been created, the function returns the error without removing the previously created groups. This incomplete cleanup path leaves stale sysfs entries and can allow the enable_sensor interface to access freed pointers in the sensor_inst->fields array. The issue has been resolved upstream by adding a local unwind path and by exposing enable_sensor only after field attributes are fully initialized.

Critical Impact
Failed sensor initialization can leave dangling sysfs entries and enable use-after-free access to sensor_inst->fields, leading to kernel memory corruption reachable from adjacent-network attack vectors.

Affected Products

Linux kernel HID sensor custom driver (drivers/hid/hid-sensor-custom.c)
Multiple upstream and stable Linux kernel branches referenced by the fix commits
Distributions shipping the vulnerable HID sensor custom module

Discovery Timeline

2026-09-11 - CVE-2026-89626 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89626

Vulnerability Analysis

The defect resides in hid_sensor_custom_add_attributes() in the Linux kernel HID sensor custom driver. The function iterates over custom sensor fields and calls sysfs_create_group() once per field. On partial failure, the function returned the error code without unwinding the sysfs groups it had already registered.

The cleanup gap has two consequences. First, orphaned sysfs group entries persist after the driver reports initialization failure. Second, and more serious, the enable_sensor attribute could be reached by user space while sensor_inst->fields was being torn down, allowing access to pointers into an array that was about to be freed. This is a classic use-after-free pattern in kernel-exposed sysfs handlers [CWE-416].

The upstream fix adds an explicit unwind loop that removes each successfully created group before returning the error. It also delays exposure of enable_sensor until after all field attributes are ready, closing the window in which user space could dereference stale field pointers.

Root Cause

The root cause is missing error-path cleanup combined with premature attribute exposure. Successful group registrations were not tracked or rolled back on subsequent failure, and the enable_sensor sysfs entry became reachable before the fields array was safe to reference.

Attack Vector

Exploitation requires an attacker able to trigger the vulnerable initialization path on a system with the HID sensor custom driver loaded. The CVSS vector indicates an adjacent-network attack surface with no privileges and no user interaction required, and high impact to confidentiality, integrity, and availability. A local or adjacent attacker who can influence HID device attachment and interact with the resulting sysfs interface may reach the use-after-free condition.

No public proof-of-concept is available. The vulnerability mechanism is described in the upstream commit messages referenced below; see the Linux Kernel Commit 3789d08 and related patches for the fix details.

Detection Methods for CVE-2026-89626

Indicators of Compromise

Kernel oops or panic entries referencing hid_sensor_custom_add_attributes or enable_sensor in dmesg and /var/log/kern.log.
KASAN reports flagging use-after-free access inside the HID sensor custom module.
Unexpected sysfs entries under HID sensor device paths that persist after a failed driver probe.

Detection Strategies

Inventory Linux hosts running kernels prior to the fix commits and correlate loaded modules against hid-sensor-custom.
Enable KASAN and lockdep in test environments to surface use-after-free and cleanup regressions during HID device attach cycles.
Monitor kernel ring buffer messages for HID sensor probe failures followed by continued sysfs activity on the failed device.

Monitoring Recommendations

Alert on repeated HID device attach and detach sequences originating from the same USB or Bluetooth peripheral.
Track kernel crash telemetry for stack traces involving hid-sensor-custom, sysfs_create_group, or sensor_inst->fields.
Baseline expected HID sensor devices per host and flag unrecognized custom sensor field enumerations.

How to Mitigate CVE-2026-89626

Immediate Actions Required

Apply the upstream Linux kernel patches listed in the references and rebuild or update affected kernel packages.
Restrict physical and adjacent-network access to USB and Bluetooth HID interfaces on sensitive systems.
Unload the hid-sensor-custom module on hosts that do not require custom HID sensor support.

Patch Information

The fix is distributed across multiple stable branches. Relevant commits include Linux Kernel Commit 10b05fa, Linux Kernel Commit 2409779, Linux Kernel Commit 3789d08, Linux Kernel Commit 4161949, Linux Kernel Commit 79154fa, Linux Kernel Commit d0e1509, Linux Kernel Commit d96f895, and Linux Kernel Commit f3f37b9. Consult your distribution's security advisories for backported kernel package versions.

Workarounds

Blacklist the hid-sensor-custom module in /etc/modprobe.d/ where custom HID sensors are not required.
Use USB device authorization policies to prevent untrusted HID devices from attaching.
Apply udev rules that restrict access to HID sensor sysfs attributes to trusted user accounts only.

bash

# Blacklist the vulnerable module until the patched kernel is deployed
echo 'blacklist hid-sensor-custom' | sudo tee /etc/modprobe.d/blacklist-hid-sensor-custom.conf
sudo modprobe -r hid-sensor-custom 2>/dev/null || true
sudo update-initramfs -u