CVE-2026-80767 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: sensor: custom: Fix use-after-free in enable_sensor
enable_sensor_store() can call set_power_report_state(), which dereferences sensor_inst->power_state and sensor_inst->report_state. These pointers refer to entries in sensor_inst->fields.
Create the field attributes before exposing the enable_sensor sysfs attribute, so enable_sensor cannot be accessed before the state it depends on has been initialized.
On remove, delete enable_sensor before freeing the field attributes, so a concurrent sysfs write cannot dereference freed memory through power_state or report_state.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel HID sensor subsystem contains a critical use-after-free vulnerability within the custom driver implementation, specifically located in the enable_sensor_store function. This flaw arises from an improper initialization and cleanup sequence regarding system file attributes and their underlying data structures. The core issue is rooted in how the driver manages the lifecycle of sensor instances and their associated field attributes. When a user interacts with the sysfs interface to modify the power state or report configuration, the enable_sensor_store function is invoked. This function subsequently calls set_power_report_state, which attempts to dereference pointers stored within the sensor_inst structure. Specifically, it accesses sensor_inst->power_state and sensor_inst->report_state, both of which are derived from entries in the sensor_inst->fields array. If these fields have not been properly initialized or if they point to memory that has already been deallocated, the kernel will attempt to read from or write to invalid addresses, leading to a use-after-free condition.
The root cause of this vulnerability is a race condition caused by incorrect ordering during both device initialization and removal phases. During the setup process, the driver exposes the enable_sensor sysfs attribute before ensuring that all dependent field attributes are fully created and initialized. This temporal gap allows an attacker or a local user to trigger the enable_sensor_store function via a write operation on the sysfs file while the underlying state variables remain uninitialized or point to garbage data. Similarly, during device removal, the driver fails to remove the enable_sensor attribute before freeing the memory associated with field attributes. Consequently, if a concurrent write request is issued at this precise moment of teardown, the kernel will attempt to access freed memory through the power_state and report_state pointers. This sequence violation results in undefined behavior, which can manifest as system crashes, data corruption, or potentially arbitrary code execution depending on how the attacker manipulates the heap state during the use-after-free window.
From a security taxonomy perspective, this vulnerability is classified under CWE-416, Use After Free, due to the dereferencing of memory that has already been released back to the system allocator. The attack vector aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as it involves interacting with a kernel interface (sysfs) to trigger malicious behavior within the operating system core. Furthermore, CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, is relevant because the vulnerability exploits a lack of proper synchronization between attribute exposure and resource initialization during device probe operations. The impact of this flaw extends beyond simple denial of service; while local privilege escalation is less common in kernel drivers without additional primitives, the instability introduced can be leveraged to bypass security controls or cause significant system unavailability for critical infrastructure relying on HID sensor data.
To mitigate this vulnerability, strict adherence to resource lifecycle management protocols is required within the driver code. The primary remediation involves reordering the initialization sequence so that all field attributes are created and fully initialized before any sysfs attribute dependent on them is exposed to user space. This ensures that when enable_sensor_store is called, the referenced power_state and report_state pointers are valid and point to allocated memory. Additionally, during device removal, the driver must explicitly remove or unregister the enable_sensor sysfs attribute prior to freeing the field attributes. This prevents any concurrent access from reaching freed memory regions. Implementing these changes eliminates the race condition by ensuring that no user-space interaction can occur against uninitialized resources or after their deallocation. System administrators should apply kernel updates containing this fix immediately, and developers auditing similar HID sensor drivers must review their probe and remove functions to ensure attribute exposure is strictly gated behind successful resource initialization.