CVE-2026-90001

Status: UPDATED  |  Advisory ID: CVE-2026-90001

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

HID: bpf: serialize device reference release in struct_ops destroy path

__hid_bpf_ops_destroy_device() and hid_bpf_unreg() can race on the

same registration reference, double-putting struct hid_device and

freeing it while hid_destroy_device() still uses it. Serialize the

remove/NULL decision under hdev->bpf.prog_list_lock so exactly one

path releases each registration reference: unreg re-checks ops->hdev

under the lock and returns without putting when the destroy path

already cleared it; all put_device() calls happen after the lock is

dropped, which is safe because a concurrent unreg then observes

ops->hdev == NULL under the lock.

Background: each successful attach (hid_bpf_ops_reg) acquires one

device reference (hid_get_device()). Two paths can release it:

- device destruction: hid_destroy_device() -> hid_bpf_destroy_device()

-> __hid_bpf_ops_destroy_device(), which walks hdev->bpf.prog_list

under rcu_read_lock() and drops one reference per attached program;

- BPF link release: bpf map delete (no BPF_F_LINK) synchronously calls

st_ops->unreg() -> hid_bpf_unreg(), which drops the reference for

its own registration.

The coordination handshake (e->hdev = NULL on the destroy side vs

"if (!hdev) return" on the unreg side) is a TOCTOU check: the two

paths run under different lock domains (rcu_read_lock vs

prog_list_lock), so a concurrent unreg can read ops->hdev as

non-NULL, block on prog_list_lock, and then proceed while the

destroy traversal executes - both paths then drop the same

reference. The refcount reaches zero legitimately (each decrement

is individually valid), so no refcount_t saturation fires: the

device is simply freed while the transport is still inside

hid_destroy_device(), and subsequent teardown touches freed memory.

The fix serializes the remove/NULL decision under prog_list_lock on

both sides and moves the destroy-side puts outside the lock. With

the lock held, plain reads/writes of ops->hdev are sufficient; no

READ_ONCE/WRITE_ONCE are added, keeping the patch minimal.

Unlocked-read safety: the unlocked read of ops->hdev at the top of

hid_bpf_unreg() cannot touch a freed device, because the unreg path

itself still holds this registration's reference (released only by

its own hid_put_device() after the lock is dropped), and a destroy

traversal that already cleared ops->hdev makes the lock-internal

re-check return early without any put. At most one of the two

paths releases each registration reference. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References