The Linux kernel HID lg-g15 driver allocates lg_g15_data with devm and schedules work items from device input report handlers. However, it lacked a remove callback to cancel pending work on device removal. If a work item is scheduled and the keyboard is unplugged before the work executes, the devres framework frees lg_g15_data while the work is still pending or running. The worker then dereferences freed memory, causing a use-after-free condition. The fix adds a remove callback that cancels pending work before freeing the state, with safeguards to avoid cancelling uninitialized work items. This vulnerability is reachable as a race condition on device unplug for affected Logitech keyboard models.

Exploitation of this use-after-free vulnerability could lead to memory corruption in the kernel, potentially allowing local attackers with access to the affected device to escalate privileges or cause denial of service. The CVSS 3.1 score is 7.8 (high impact on confidentiality, integrity, and availability). No known exploits in the wild have been reported.

A patch is available and should be applied by updating to the fixed Linux kernel versions as specified in the Ubuntu security advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required. The fix introduces a remove callback that cancels pending work items to prevent use-after-free. Users should ensure they install the updated linux-hwe-edge kernel packages at or above the fixed versions. No additional mitigation is required beyond applying the official fix.