CVE-2026-90001

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: bpf: serialize device reference release in struct_ops destroy path

__hid_bpf_ops_destroy_device() and hid_bpf_unreg() can race on the

same registration reference, double-putting struct hid_device and

freeing it while hid_destroy_device() still uses it. Serialize the

remove/NULL decision under hdev->bpf.prog_list_lock so exactly one

path releases each registration reference: unreg re-checks ops->hdev

under the lock and returns without putting when the destroy path

already cleared it; all put_device() calls happen after the lock is

dropped, which is safe because a concurrent unreg then observes

ops->hdev == NULL under the lock.

Background: each successful attach (hid_bpf_ops_reg) acquires one

device reference (hid_get_device()). Two paths can release it:

- device destruction: hid_destroy_device() -> hid_bpf_destroy_device()

-> __hid_bpf_ops_destroy_device(), which walks hdev->bpf.prog_list

under rcu_read_l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References