CVE-2026-90001

A flaw was found in the Linux kernel's HID (Human Interface Device) BPF (Berkeley Packet Filter) component. A race condition exists between the device destruction and BPF link release paths, which can lead to a struct hid_device being freed twice. This double-free vulnerability results in a use-after-free condition, where the system attempts to access memory that has already been released. A local attacker could potentially exploit this to cause system instability, a denial of service, or possibly achieve arbitrary code execution.

A race in the HID BPF struct_ops destroy path can allow __hid_bpf_ops_destroy_device and hid_bpf_unreg to release the same hid_device registration reference. This can double put struct hid_device and free it while hid_destroy_device is still using the object, creating a kernel use after free condition. For the CVSS the PR:L is used because exploitation requires local code able to interact with HID BPF or a process holding the needed BPF related capability, but it does not necessarily require full unrestricted root in practical deployments. The issue is not network reachable and depends on racing BPF link or map release with HID device teardown. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel UAF memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.