CVE-2026-90329

A flaw was found in the Human Interface Device (HID) subsystem of the Linux kernel. This vulnerability arises from a race condition during the probe process, where report callbacks can attempt to access resources that have already been freed due to a failed probe. This can lead to a use-after-free error, potentially allowing a local attacker to cause a denial of service or escalate privileges.

A race in the HID failed probe path can allow report callbacks to run while __hid_device_probe() is freeing driver resources and clearing the device driver pointer. A report can enter hidraw_report_event() while the related hidraw object is being released, which creates a use after free when the callback touches the freed object lock or list state. For the CVSS the PR:L is used for the paranoid case because a low privileged local user may be able to reach this path if the environment exposes virtual HID creation or delegated device control such as UHID. The issue is not directly network reachable in the normal USB HID case. Bluetooth or other HID transports may change practical exposure, but they still depend on local pairing and device access conditions. Impact is at least denial of service via kernel crash. Because the bug is a race based use after free in kernel memory, worst case confidentiality and integrity impact should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.