CVE-2026-64362

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the HID lg-g15 driver. The lg g15 data structure is allocated using devm and contains a work item scheduled by report handlers from device input, specifically within the lg g15 event(), lg g15 v2 event(), and lg g510 leds event() functions. Because the driver lacked a remove callback to cancel pending work, unplugging the keyboard could lead to a race condition where devres frees lg g15 data while the worker is still pending or running, causing the worker to access freed memory.

Recommendations Implement a remove callback that cancels the work associated with g15->work before the state is freed by devres. For models G15, G15 v2, and G510, ensure the cancel operation is guarded by a check on g15->work.func to prevent cancelling uninitialized work.