CVE-2026-64362 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: lg-g15: cancel pending work on remove to fix a use-after-free
lg_g15_data is allocated with devm and holds a work item. The report handlers schedule that work straight from device input. lg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key, and lg_g510_leds_event() does it too. The worker dereferences the lg_g15_data back through container_of.
The driver had no remove callback and never cancelled the work. So if a report scheduled the work and the keyboard was then unplugged, devres freed lg_g15_data while the work was still pending or running, and the worker touched freed memory. This is a use-after-free. It is reachable as a race on device unplug.
Add a remove callback that cancels the work before devres frees the state. g15->work is only initialized for the models that schedule it (G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the cancel on g15->work.func to avoid cancelling a work that was never set up. The g15 NULL test mirrors the one already in lg_g15_raw_event().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability described represents a critical use-after-free condition in the Linux kernel's HID driver for Logitech G15 gaming keyboards and related devices. This flaw exists within the lg-g15 driver component that handles input reporting for specific Logitech gaming peripherals including the G15, G15 v2, and G510 models. The technical implementation involves a complex interaction between device memory management and asynchronous work queue processing that creates a race condition during device removal operations.
The root cause stems from improper resource cleanup mechanisms within the driver's lifecycle management. When a Logitech G15 keyboard is unplugged while input reports are still being processed, the driver fails to properly cancel pending work items before releasing allocated memory resources. The lg_g15_data structure is managed through the device resource manager (devm) which automatically frees memory when the device is removed, but this occurs without first cancelling asynchronous work items that may be scheduled to run later. This fundamental design flaw creates a scenario where the worker function attempts to access freed memory through container_of operations, resulting in undefined behavior and potential system instability.
The operational impact of this vulnerability extends beyond simple memory corruption, as it represents a serious security risk that could potentially enable privilege escalation or system crashes under specific conditions. Attackers could exploit this race condition by rapidly unplugging and replugging affected devices while input reports are being processed, creating opportunities for malicious code execution or denial-of-service attacks. The vulnerability specifically targets the backlight cycle key reporting functionality and LED control handlers which schedule work items through lg_g15_event(), lg_g15_v2_event(), and lg_g510_leds_event() functions. This pattern of asynchronous processing combined with inadequate cleanup creates a persistent threat vector that affects multiple generations of Logitech gaming hardware.
The mitigation strategy implemented addresses the core issue by introducing a proper remove callback that explicitly cancels pending work items before device resources are freed. This solution aligns with established best practices for kernel driver development and follows the principle of resource management safety. The implementation carefully handles the conditional initialization of work items by checking g15->work.func before attempting cancellation, ensuring compatibility with different keyboard models that may not initialize all work structures. This approach directly addresses the race condition described in CWE-416, which specifically covers use-after-free vulnerabilities in memory management scenarios.
The fix demonstrates proper adherence to kernel security standards and follows the ATT&CK framework's concept of privilege escalation through resource manipulation. By implementing the removal callback with appropriate null checks and conditional work cancellation, the driver now properly manages its asynchronous processing lifecycle. This remediation ensures that device memory cleanup operations occur in the correct sequence, preventing access to freed structures while maintaining backward compatibility with existing functionality. The solution specifically targets the device removal path where the race condition occurs, making it a targeted and effective fix that doesn't impact normal device operation or introduce new security concerns.
The vulnerability resolution reflects a comprehensive understanding of Linux kernel memory management patterns and asynchronous processing mechanisms. The implementation carefully considers the different hardware variants supported by the driver, ensuring that work item cancellation only occurs when necessary and that the fix maintains compatibility with both legacy and newer G15 family devices. This approach prevents potential regressions while addressing the specific use-after-free scenario that could be exploited in real-world attack conditions. The solution's effectiveness is validated through proper device resource lifecycle management that prevents the memory access violations inherent in the original implementation.