CVE-2026-64595

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()

hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it

to run 2 ms later:

INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup);

schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2));

cfg_setup() dereferences drvdata.hdev to issue MCU command requests.

hid_go_cfg_remove() tears down sysfs and stops the HID device, but

never drains the delayed work. If the device is unbound within the

2 ms scheduling delay (a probe failure rolling back via remove, or a

fast rmmod after probe), the work fires after hid_destroy_device()

has dropped its reference and released the underlying hdev struct,

leaving cfg_setup() with a stale drvdata.hdev pointer.

Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove()

already calls cancel_delayed_work_sync() on its analogous work, and

drain go_cfg_setup at the top of hid_go_cfg

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References