CVE-2026-64595

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()<br /> <br /> hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it<br /> to run 2 ms later:<br /> <br /> INIT_DELAYED_WORK(&amp;drvdata.go_cfg_setup, &amp;cfg_setup);<br /> schedule_delayed_work(&amp;drvdata.go_cfg_setup, msecs_to_jiffies(2));<br /> <br /> cfg_setup() dereferences drvdata.hdev to issue MCU command requests.<br /> hid_go_cfg_remove() tears down sysfs and stops the HID device, but<br /> never drains the delayed work. If the device is unbound within the<br /> 2 ms scheduling delay (a probe failure rolling back via remove, or a<br /> fast rmmod after probe), the work fires after hid_destroy_device()<br /> has dropped its reference and released the underlying hdev struct,<br /> leaving cfg_setup() with a stale drvdata.hdev pointer.<br /> <br /> Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove()<br /> already calls cancel_delayed_work_sync() on its analogous work, and<br /> drain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel<br /> must come before guard(mutex)(&amp;drvdata.cfg_mutex) because cfg_setup()<br /> acquires that mutex; reversing the order would deadlock.