CVE-2026-64595 Linux CVE debrief

Who should care

Linux kernel developers and users, HID: hid-lenovo-go driver users, security teams, and operators of affected systems should be aware of this vulnerability and take necessary precautions to mitigate its impact. Affected product deployments should be identified and prioritized for patching or mitigation. Security teams should review system logs and monitor for potential use-after-free errors in the HID: hid-lenovo-go driver. Operators of affected systems should ensure that the Linux kernel is updated to a version that includes the fix and that the HID: hid-lenovo-go driver is properly configured and monitored. Vulnerability management teams should track this vulnerability and ensure that affected systems are properly patched or mitigated. Compensating controls, such as monitoring and detection, should be implemented to reduce the risk of exploitation. Asset inventory and rollback/change windows should be reviewed to ensure that affected systems are properly managed. Source tracking should be implemented to monitor for potential exploitation attempts. Security teams should also review the Linux kernel's HID: hid-lenovo-go driver source code and verify that the fix has been properly implemented. This may involve reviewing system logs, monitoring for potential use-after-free errors, and verifying that the `cancel_delayed_work_sync` call has been added to `hid_go_cfg_remove`. Additionally, security teams should ensure that the Linux kernel is updated to a version that includes the fix and that the HID: hid-lenovo-go driver is properly configured and monitored. This may involve coordinating with Linux kernel developers and HID: hid-lenovo-go driver users to ensure that the fix is properly implemented and that affected systems are properly patched or mitigated. Overall, a coordinated effort is required to mitigate the impact of this vulnerability and prevent potential exploitation. This includes reviewing system logs, monitoring for potential use-after-free errors, and verifying that the fix has been properly implemented. By taking these precautions, defenders can reduce the risk of exploitation and ensure that affected systems are properly protected. To further verify

Technical summary

The `hid_go_cfg_probe` function in the Linux kernel's HID: hid-lenovo-go driver schedules a delayed work `go_cfg_setup` to run 2 ms later. However, the `hid_go_cfg_remove` function does not cancel this delayed work, leading to a potential use-after-free error if the device is unbound within the 2 ms scheduling delay. The vulnerability was resolved by adding a call to `cancel_delayed_work_sync` in `hid_go_cfg_remove` to drain the `go_cfg_setup` work.

Defensive priority

High

Recommended defensive actions

• Apply the patch to cancel the delayed work in hid_go_cfg_remove
• Monitor for potential use-after-free errors in the HID: hid-lenovo-go driver
• Inventory Linux kernel versions and HID: hid-lenovo-go driver installations for potential vulnerabilities
• Review system logs for related issues
• Verify that the fix has been properly implemented
• Track exceptions and retest remediated assets
• Implement source tracking to monitor for potential exploitation attempts

Evidence notes

The vulnerability was resolved by adding a call to `cancel_delayed_work_sync` in `hid_go_cfg_remove` to drain the `go_cfg_setup` work. This fix mirrors the sibling driver `hid-lenovo-go-s.c`. To verify, defenders should review the Linux kernel's HID: hid-lenovo-go driver source code and check for the presence of the `cancel_delayed_work_sync` call in `hid_go_cfg_remove`. Additionally, defenders should monitor for potential use-after-free errors in the HID: hid-lenovo-go driver and review system logs for related issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.