CVE-2026-80767 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and prioritize verification of affected systems. They should review Linux kernel configurations and versions to determine exposure, verify system configurations and installed packages for potential vulnerability, and monitor system logs for suspicious activity related to the HID sensor custom driver. Affected operator, platform, vulnerability-management, and security-team impact

Why it matters

A use-after-free vulnerability in the Linux kernel's HID sensor custom driver has been resolved. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems.

• Verify Linux kernel configurations and versions to determine exposure
• Assess system configurations and installed packages for potential vulnerability
• Monitor system logs for suspicious activity related to the HID sensor custom driver

Technical summary

The Linux kernel's HID sensor custom driver has a use-after-free vulnerability in the enable_sensor_store function. The function can call set_power_report_state, which dereferences sensor_inst->power_state and sensor_inst->report_state. These pointers refer to entries in sensor_inst->fields. To fix the issue, field attributes are created before exposing the enable_sensor sysfs attribute. This ensures that enable_sensor cannot be accessed before the state it depends on has been initialized. On remove, delete enable_sensor before freeing the field attributes, so a concurrent sysfs write cannot dereference freed memory through power_state or report_state. The fix involves creating field attributes before

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems.

Recommended defensive actions

• Review Linux kernel configurations and versions to determine exposure
• Verify system configurations and installed packages for potential vulnerability
• Monitor system logs for suspicious activity related to the HID sensor custom driver
• Apply patches or updates provided by the Linux kernel maintainers
• Track exceptions and retest remediated assets
• Close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the affected versions and exploitation status are not specified. Linux kernel maintainers and users should verify Linux kernel configurations and versions to determine exposure, assess system configurations and installed packages for potential vulnerability, and monitor system logs for suspicious activity related to the HID sensor custom driver. Evidence is limited, and defenders should focus on verifying affected systems and applying patches or updates provided by

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.