CVE-2026-90331 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: asus: refactor the two workqueues and init sequence
Multiple issues have been found within the hid-asus driver: - unchecked size in asus_raw_event() - unclean teardown of asus_probe on failure - possible use-after-free in asus_probe - multiple workqueue used for jobs where one was enough - sleeping calls in atomic context - packets of incorrect size being sent to the keyboard controller
Join the two workqueues into one reusing the stopping mechanism of the brightness workqueue, use the joined workqueue to also move the asus_wmi_send_event() sleeping call away from atomic context and add a size check in asus_raw_event().
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's hid-asus driver contained several critical implementation flaws that compromised system stability and security. These issues stemmed primarily from improper resource management, incorrect handling of asynchronous operations, and insufficient input validation. The core problem involved the use of multiple workqueues for tasks where a single unified queue would have been more appropriate, leading to complex synchronization challenges and potential race conditions. Additionally, the driver failed to properly validate data sizes during raw event processing, allowing potentially malicious or malformed inputs to trigger undefined behavior within the kernel space.
A significant portion of these vulnerabilities relates to improper memory management and lifecycle handling. Specifically, the asus_probe function exhibited an unclean teardown sequence upon failure, which could leave resources in an inconsistent state. More critically, there was a possible use-after-free condition during this probe routine, where pointers might be accessed after their associated memory had been deallocated. This type of flaw is particularly dangerous as it can lead to arbitrary code execution if an attacker can control the contents of the freed memory region before it is reallocated for another purpose. The lack of robust error handling paths meant that partial initialization states could persist, increasing the attack surface for exploitation attempts targeting driver initialization routines.
The operational impact was further exacerbated by scheduling violations and incorrect packet sizes being transmitted to hardware controllers. Sleeping calls were executed within atomic context in certain code paths, violating kernel concurrency rules and potentially causing deadlocks or system hangs when interrupts occurred during these operations. Furthermore, packets of incorrect size were sent to the keyboard controller without adequate bounds checking. This lack of input validation allows for buffer overflows or corruption of internal driver structures, which can be leveraged by local attackers with physical access to trigger denial-of-service conditions or escalate privileges through kernel memory corruption.
These issues are categorized under CWE-416 Use After Free and CWE-20 Improper Input Validation within the Common Weakness Enumeration framework. The improper scheduling practices align with CWE-362 Concurrent Execution Using Shared Resource without Proper Synchronization, while the atomic context violations relate to CWE-755 Improper Handling of Exceptional Conditions. From a threat modeling perspective using MITRE ATT&CK techniques, these flaws facilitate Local Privilege Escalation (T1068) and Denial of Service via resource exhaustion or crash induction (T1499). The use-after-free vulnerability specifically enables potential code execution pathways that attackers can exploit to gain higher-level permissions on the affected system.
To mitigate these risks, the driver was refactored to consolidate multiple workqueues into a single unified queue, reusing the stopping mechanism of the brightness workqueue for consistency and reliability. This change simplifies synchronization logic and reduces the likelihood of race conditions arising from concurrent access patterns. The asus_wmi_send_event function's sleeping call was moved out of atomic context to prevent scheduling violations that could lead to system instability. Additionally, a strict size check was implemented in the asus_raw_event handler to ensure that only valid packet sizes are processed, thereby preventing buffer overflows and memory corruption attacks derived from malformed HID reports. These changes collectively enhance the robustness of the driver against both accidental failures and intentional exploitation attempts.