SB20260912165 - Use-after-free in Linux kernel hid driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-89625)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in GHL poke timer handling in the hid-sony driver when handling driver unbind while a GHL poke URB is in flight. A local privileged user can trigger a driver unbind while the GHL poke URB is in flight to cause a use-after-free condition.

The issue affects Guitar Hero Live dongles, where a URB completion can re-arm the timer after driver teardown.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/114a58640aaf3c2eb97b5b01c75ab5e541d15d9c
• https://git.kernel.org/stable/c/3155dc327344d286f17345cd371be05e255a4328
• https://git.kernel.org/stable/c/a26705bd2e2728833e7a538ce91e58a5eeff496a