In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use cancel_delayed_work_sync() in remove oxp_hid_remove() uses… (CVE-2026-98500)

The Linux kernel hid-oxp driver previously used cancel_delayed_work() in the oxp_hid_remove() function to cancel three delayed work items. However, cancel_delayed_work() only dequeues pending work without waiting for any currently executing callbacks to finish. This could lead to race conditions where callbacks (oxp_rgb_queue_fn, oxp_btn_queue_fn, oxp_mcu_init_fn) run concurrently with hid_hw_close() and hid_hw_stop(), accessing the device after it was closed. The vulnerability was resolved by replacing cancel_delayed_work() with cancel_delayed_work_sync(), which waits for any running work callbacks to complete before proceeding with device teardown.

The vulnerability could cause use-after-free or race conditions by allowing work callbacks to access the HID device after it has been closed and stopped. This may lead to undefined behavior or potential system instability. No information about exploitation in the wild is available.

A fix is available that replaces cancel_delayed_work() with cancel_delayed_work_sync() in the oxp_hid_remove() function. Users should apply the updated Linux kernel version containing this fix to ensure proper synchronization during device removal.