CVE-2026-89625

A flaw was found in the Linux kernel's HID (Human Interface Device) Sony driver, affecting Guitar Hero Live (GHL) dongles. A race condition occurs during the driver unbinding process where a periodic timer can be re-armed after the memory it uses has been freed. This Use-After-Free (UAF) vulnerability can lead to system instability or crashes, and potentially allow for more severe system compromise.

A use-after-free can occur in the HID Sony GHL teardown path because timer_delete_sync() does not prevent the GHL poke timer from being rearmed and usb_free_urb() does not kill an in flight URB. A URB completion can run after the timer delete step, rearm ghl_poke_timer, and later make the timer callback access the freed sony_sc object after driver unbind or device removal. For the CVSS the PR:N because a physical attacker with a controlled USB device does not need a local account on the victim, although local unbind or rmmod based triggering would normally require administrator privileges. The issue is not network reachable and requires access to the affected USB HID device path. Impact is at least denial of service via kernel crash. Because the primitive is a kernel use-after-free in a timer softirq path, worst case confidentiality and integrity impact should be reviewed manually even though practical exploitation beyond DoS is likely difficult.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.