CVE-2026-80767

What it actually does

Use-after-free in the HID sensor custom driver where enable_sensor_store dereferences power_state and report_state pointers into fields that may already be freed on concurrent access or during module removal.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or potentially escalate privileges, leading to system instability or full host compromise on multi-user or containerized environments.

How an attack unfolds

An attacker with local access writes to the enable_sensor sysfs attribute while the driver is unloading or before fields are initialized, causing the kernel to dereference freed memory through the state pointers.

How to fix it

Update to a kernel containing the fix that initializes field attributes before exposing enable_sensor and removes the attribute before freeing fields; apply the latest stable kernel for your distribution.

How to confirm the fix worked

Confirm the sysfs attribute creation order matches the fixed sequence in the sensor custom driver source and that the remove path deletes enable_sensor prior to field deallocation.

Typical attack path

1. Obtain local shell access on a vulnerable kernel
2. Locate the HID sensor sysfs enable_sensor attribute
3. Trigger concurrent write during module removal or initialization race
4. Cause use-after-free dereference leading to crash or controlled memory access

How to detect it

Review kernel logs for use-after-free warnings or oops in the hid-sensor-custom module, and inspect sysfs interaction timing around module load/unload events.

What your security team should do

• Prioritize kernel updates on systems exposing HID sensor sysfs interfaces
• Monitor for local privilege-escalation attempts targeting sensor drivers
• Restrict untrusted local user access to sysfs HID entries until patched