CVE-2026-64362

A flaw was found in the Linux kernel's lg-g15 Human Interface Device (HID) driver. This vulnerability, a use-after-free, occurs when a Logitech G15, G15 v2, or G510 keyboard is unplugged while a work item is pending. The driver fails to properly cancel this pending work, allowing it to access memory that has already been freed. This race condition can lead to system instability or crashes.

This vulnerability is rated Moderate rather than Important because exploitation requires local access and physical interaction to attach and disconnect specific Logitech gaming hardware, substantially limiting exposure on standard Red Hat enterprise deployments. In virtualized environments, a privileged local user could simulate device detachment to trigger the condition. Because typical server systems do not utilize these specialized input devices, the real-world attack surface is minimal and restricted to a local denial-of-service crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.