Description
In the Linux kernel, the following vulnerability has been resolved:

HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()

hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it
to run 2 ms later:

INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup);
schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2));

cfg_setup() dereferences drvdata.hdev to issue MCU command requests.
hid_go_cfg_remove() tears down sysfs and stops the HID device, but
never drains the delayed work. If the device is unbound within the
2 ms scheduling delay (a probe failure rolling back via remove, or a
fast rmmod after probe), the work fires after hid_destroy_device()
has dropped its reference and released the underlying hdev struct,
leaving cfg_setup() with a stale drvdata.hdev pointer.

Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove()
already calls cancel_delayed_work_sync() on its analogous work, and
drain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel
must come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup()
acquires that mutex; reversing the order would deadlock.
Published: 2026-08-06
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw occurs in the hid-lenovo-go driver when a delayed configuration work item is scheduled during probe but never cancelled when the device is removed. If the device is unbound within the two‑millisecond window, that work runs against a freed hdev structure, dereferencing a stale pointer and causing a kernel crash.

Affected Systems

All Linux systems that load the hid-lenovo-go driver and have not yet incorporated the relevant commit are affected. The vendor is Linux, and the issue exists in any kernel that contains the original probe and remove code paths; specific kernel release numbers are not provided in the advisory.

Risk and Exploitability

The problem is a local use‑after‑free that can lead to a kernel panic and denial of service. It is not listed in CISA’s KEV catalog and the EPSS score is not available, so the probability of active exploitation is unknown. No CVSS score is provided in the data, but the nature of the bug suggests a high severity if triggered.

Generated by OpenCVE AI on August 6, 2026 at 09:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the kernel to a version that includes the commits referenced in the advisory (3e7761f7bf9f0187bb18cf52b5119bdf4940e686 or 73fde0cbff7d9d618591774a12c23434232752c1) to de‑schedule the faulty work item
  • If the kernel cannot be updated immediately, blacklist or unload the hid‑lenovo‑go module to prevent it from loading and remove the vulnerable work path from the system
  • Alternatively, use udev rules or kernel options to block detection of the Lenovo Go HID device, which stops the driver from being instantiated

Generated by OpenCVE AI on August 6, 2026 at 09:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Thu, 06 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it to run 2 ms later: INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup); schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2)); cfg_setup() dereferences drvdata.hdev to issue MCU command requests. hid_go_cfg_remove() tears down sysfs and stops the HID device, but never drains the delayed work. If the device is unbound within the 2 ms scheduling delay (a probe failure rolling back via remove, or a fast rmmod after probe), the work fires after hid_destroy_device() has dropped its reference and released the underlying hdev struct, leaving cfg_setup() with a stale drvdata.hdev pointer. Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove() already calls cancel_delayed_work_sync() on its analogous work, and drain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel must come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup() acquires that mutex; reversing the order would deadlock.
Title HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-06T07:13:50.918Z

Reserved: 2026-07-19T15:36:31.799Z

Link: CVE-2026-64595

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T10:00:05Z

Weaknesses