CVE-2026-64603

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: intel-hid: Protect ACPI notify handler against recursion

Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on

all CPUs") ACPI notify handlers like the intel-hid notify_handler() may

run on multiple CPU cores racing with themselves.

On convertibles and detachables (matched by DMI chassis-type 31 and 32 in

dmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered

lazily from notify_handler() on the first tablet-mode event, via

intel_hid_switches_setup(). When two such events race on different CPUs

both can pass the !priv->switches check and register the priv->switches

input device twice, resulting in a duplicate sysfs entry and a subsequent

NULL pointer dereference.

This is the same class of bug fixed by commit e075c3b13a0a ("platform/x86:

intel-vbtn: Protect ACPI notify handler against recursion") for the

sibling intel-vbtn driver.

Protect intel-hid notify_handler() fro

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References