CVE-2026-64595

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64595", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.799Z", "datePublished": "2026-08-06T07:13:50.918Z", "dateUpdated": "2026-08-17T04:58:17.545Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:58:17.545Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()\n\nhid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it\nto run 2 ms later:\n\n INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup);\n schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2));\n\ncfg_setup() dereferences drvdata.hdev to issue MCU command requests.\nhid_go_cfg_remove() tears down sysfs and stops the HID device, but\nnever drains the delayed work. If the device is unbound within the\n2 ms scheduling delay (a probe failure rolling back via remove, or a\nfast rmmod after probe), the work fires after hid_destroy_device()\nhas dropped its reference and released the underlying hdev struct,\nleaving cfg_setup() with a stale drvdata.hdev pointer.\n\nMirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove()\nalready calls cancel_delayed_work_sync() on its analogous work, and\ndrain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel\nmust come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup()\nacquires that mutex; reversing the order would deadlock."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/hid-lenovo-go.c"], "versions": [{"version": "d69ccfcbc9551988190895bc125a8bf709aa5931", "lessThan": "3e7761f7bf9f0187bb18cf52b5119bdf4940e686", "status": "affected", "versionType": "git"}, {"version": "d69ccfcbc9551988190895bc125a8bf709aa5931", "lessThan": "73fde0cbff7d9d618591774a12c23434232752c1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/hid-lenovo-go.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3e7761f7bf9f0187bb18cf52b5119bdf4940e686"}, {"url": "https://git.kernel.org/stable/c/73fde0cbff7d9d618591774a12c23434232752c1"}], "title": "HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hid/hid-lenovo-go.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3e7761f7bf9f0187bb18cf52b5119bdf4940e686", "status": "affected", "version": "d69ccfcbc9551988190895bc125a8bf709aa5931", "versionType": "git"}, {"lessThan": "73fde0cbff7d9d618591774a12c23434232752c1", "status": "affected", "version": "d69ccfcbc9551988190895bc125a8bf709aa5931", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hid/hid-lenovo-go.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()\n\nhid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it\nto run 2 ms later:\n\n INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup);\n schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2));\n\ncfg_setup() dereferences drvdata.hdev to issue MCU command requests.\nhid_go_cfg_remove() tears down sysfs and stops the HID device, but\nnever drains the delayed work. If the device is unbound within the\n2 ms scheduling delay (a probe failure rolling back via remove, or a\nfast rmmod after probe), the work fires after hid_destroy_device()\nhas dropped its reference and released the underlying hdev struct,\nleaving cfg_setup() with a stale drvdata.hdev pointer.\n\nMirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove()\nalready calls cancel_delayed_work_sync() on its analogous work, and\ndrain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel\nmust come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup()\nacquires that mutex; reversing the order would deadlock."}], "id": "CVE-2026-64595", "lastModified": "2026-08-17T05:18:06.017", "metrics": {}, "published": "2026-08-06T08:16:35.097", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e7761f7bf9f0187bb18cf52b5119bdf4940e686"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/73fde0cbff7d9d618591774a12c23434232752c1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d69ccfcbc9551988190895bc125a8bf709aa5931,3e7761f7bf9f0187bb18cf52b5119bdf4940e686)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d69ccfcbc9551988190895bc125a8bf709aa5931,73fde0cbff7d9d618591774a12c23434232752c1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-06T09:00:10.478657+00:00", "updated": "2026-08-06T10:00:05.967726+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}