CVE-2026-89625

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind

For GHL (Guitar Hero Live) dongles, sony_probe() arms a periodic timer:

ghl_magic_poke() (the timer callback) submits sc->ghl_urb, and the URB

completion ghl_magic_poke_cb() re-arms the timer with mod_timer().

sony_remove() drained the timer with timer_delete_sync() and then freed

the URB with usb_free_urb():

timer_delete_sync(&sc->ghl_poke_timer);

usb_free_urb(sc->ghl_urb);

timer_delete_sync() does not block re-arming, and while the URB is in

flight the timer is not pending, so the sync delete is a no-op. A URB

completion that runs after the delete re-arms the timer, and usb_free_urb()

only drops a reference -- it does not kill an in-flight URB. sc is

allocated with devm_kzalloc() and freed once sony_remove() returns, so the

re-armed ghl_poke_timer (embedded in sc) then fires on freed memory, a

use-after-free from timer softirq. This is a disconnec

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References