CVE-2026-90001

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists between the hid bpf ops destroy device() and hid bpf unreg() functions. This occurs because the coordination between device destruction and BPF link release uses a TOCTOU (Time-of-Check to Time-of-Use) check across different lock domains. Specifically, a concurrent unregistration can read a device reference as non-NULL and proceed to drop it while the destruction path is also dropping the same reference. This leads to a double-put of the struct hid device, causing the device to be freed while hid destroy device() is still utilizing it, which results in a use-after-free scenario where subsequent teardown operations access freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.