The Linux kernel HID sony driver for Guitar Hero Live dongles had a use-after-free vulnerability triggered during driver unbind. The driver arms a periodic timer that submits a URB and re-arms itself upon URB completion. During removal, the timer was deleted synchronously and the URB freed, but the timer deletion did not block re-arming, and the URB completion could re-arm the timer on freed memory. The URB was only reference-dropped, not killed, allowing re-submission after free. The vulnerability was fixed by poisoning the URB to kill in-flight URBs and prevent further submissions, and by properly shutting down the timer to block re-arming. This prevents the timer callback from firing on freed memory, eliminating the use-after-free race condition.

This vulnerability can cause a use-after-free condition in kernel memory, potentially leading to system instability or crashes. It arises during driver unbind and removal of the affected device. There is no indication of known exploits in the wild. The impact is primarily a kernel memory corruption issue that could be triggered by disconnecting or removing the affected device.

A fix has been implemented in the Linux kernel to address this vulnerability by poisoning the URB and properly shutting down the timer before freeing resources. Users should apply the official kernel updates that include this fix. No additional mitigation is required if the fixed kernel version is in use.