The Linux kernel's intel-hid ACPI notify handler was vulnerable to race conditions caused by concurrent execution on multiple CPU cores. Specifically, on convertible and detachable devices identified by DMI chassis types 31 and 32, the SW_TABLET_MODE input device registration could be triggered simultaneously on different CPUs, bypassing checks and causing duplicate sysfs entries. This leads to a NULL pointer dereference. The vulnerability is similar to a previously fixed issue in the intel-vbtn driver. The fix involves protecting the notify handler against recursion and concurrent races. This vulnerability is tracked as CVE-2026-64603 and affects linux-hwe-edge kernel versions prior to 7.0.0-31.31 and related builds.

A local race condition in the intel-hid ACPI notify handler could cause a NULL pointer dereference, potentially leading to kernel crashes or denial of service on affected systems. The vulnerability arises from concurrent input device registration on convertible and detachable devices. There is no indication of remote exploitation or privilege escalation in the provided data.

A vendor-provided patch is available and should be applied by updating the Linux kernel to versions 7.0.0-31.31 or later (and related fixed builds). After updating, a system reboot is required. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Follow the vendor's update instructions to ensure full remediation.