Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()… (CVE-2026-64595)
In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it to run 2 ms later: INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup); schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2)); cfg_setup() dereferences drvdata.hdev to issue MCU command requests. hid_go_cfg_remove() tears down sysfs and stops the HID device, but never drains the delayed work. If the device is unbound within the 2 ms scheduling delay (a probe failure rolling back via remove, or a fast rmmod after probe), the work fires after hid_destroy_device() has dropped its reference and released the underlying hdev struct, leaving cfg_setup() with a stale drvdata.hdev pointer. Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove() already calls cancel_delayed_work_sync() on its analogous work, and drain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel must come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup() acquires that mutex; reversing the order would deadlock.
AI Analysis
Technical Summary
The Linux kernel hid-lenovo-go driver schedules a delayed work task (cfg_setup) that accesses the device's hardware data structure (drvdata.hdev). If the device is removed or unbound within the 2 ms delay before the work executes, the underlying device structure may be freed, causing the delayed work to dereference a stale pointer. The fix mirrors a sibling driver by canceling the delayed work synchronously in the remove function before tearing down the device, preventing use-after-free conditions and potential kernel crashes.
Potential Impact
This vulnerability could cause kernel instability or crashes due to use-after-free when the delayed work accesses freed memory. While no active exploits are known, such memory corruption issues can potentially be leveraged for denial of service or privilege escalation in certain contexts.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to cancel the delayed work synchronously during device removal, preventing use-after-free. Users should update to a kernel version that includes this patch. Since this is a kernel-level fix, no additional mitigations are required beyond applying the official patch.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()… (CVE-2026-64595)
Description
In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it to run 2 ms later: INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup); schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2)); cfg_setup() dereferences drvdata.hdev to issue MCU command requests. hid_go_cfg_remove() tears down sysfs and stops the HID device, but never drains the delayed work. If the device is unbound within the 2 ms scheduling delay (a probe failure rolling back via remove, or a fast rmmod after probe), the work fires after hid_destroy_device() has dropped its reference and released the underlying hdev struct, leaving cfg_setup() with a stale drvdata.hdev pointer. Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove() already calls cancel_delayed_work_sync() on its analogous work, and drain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel must come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup() acquires that mutex; reversing the order would deadlock.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel hid-lenovo-go driver schedules a delayed work task (cfg_setup) that accesses the device's hardware data structure (drvdata.hdev). If the device is removed or unbound within the 2 ms delay before the work executes, the underlying device structure may be freed, causing the delayed work to dereference a stale pointer. The fix mirrors a sibling driver by canceling the delayed work synchronously in the remove function before tearing down the device, preventing use-after-free conditions and potential kernel crashes.
Potential Impact
This vulnerability could cause kernel instability or crashes due to use-after-free when the delayed work accesses freed memory. While no active exploits are known, such memory corruption issues can potentially be leveraged for denial of service or privilege escalation in certain contexts.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to cancel the delayed work synchronously during device removal, preventing use-after-free. Users should update to a kernel version that includes this patch. Since this is a kernel-level fix, no additional mitigations are required beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ch5w-wf8g-jr9p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64595"]
Threat ID: 6a74cfa0bf8831d5391b076f
Added to database: 08/06/2026, 18:17:04 UTC
Last enriched: 08/06/2026, 19:11:43 UTC
Last updated: 09/21/2026, 22:01:36 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.