CVE-2026-89625

What it actually does

A use-after-free in the Linux kernel HID Sony driver (hid-sony) races a Guitar Hero Live (GHL) poke timer against driver unbind. sony_probe() arms a periodic timer whose callback submits sc->ghl_urb; the URB completion re-arms the timer. sony_remove() used timer_delete_sync() then usb_free_urb(), but timer_delete_sync() does not block re-arming and is a no-op while the URB is in flight (timer not pending). A completion after the delete re-arms the timer; usb_free_urb() only drops a reference and does not kill an in-flight URB. sc is devm-allocated and freed when remove returns, so the re-armed timer (embedded in sc) later fires from timer softirq against freed memory, enabling kernel memory corruption, a panic, or local privilege escalation.

Why it matters to the business

Hosts that load hid-sony and attach GHL-class USB dongles (or equivalent USB gadget emulation) can suffer kernel panics and sudden outages when the device is unplugged or the driver is unbound; a successful use-after-free could also yield local privilege escalation and full host compromise. Impact is concentrated on Linux desktops, kiosks, labs, and embedded systems that allow USB HID gaming dongles or unprivileged unbind/rmmod. The flaw is not in CISA KEV, is not associated with ransomware campaigns, and has no public exploit maturity about 38 days after publication, so urgency is moderate rather than emergency, but unpatched kernels with this driver remain a local-attack and stability risk until the teardown-order fix is applied.

How an attack unfolds

An attacker with local access on a vulnerable Linux kernel causes hid-sony to bind to a GHL-compatible USB device so the periodic poke timer and URB are armed. They keep a poke URB in flight so the timer is not pending, then trigger driver teardown (USB disconnect, sysfs unbind, or module unload). Because the old remove path did not poison the URB or shut down the timer against re-arming, the in-flight completion can re-arm ghl_poke_timer on driver state that is then freed. Seconds later the timer softirq runs ghl_magic_poke on the freed object, producing a use-after-free that can crash the kernel or be leveraged for memory corruption and privilege escalation. Exploitation is a disconnect/rmmod race, not a remote network attack, and requires the Sony GHL HID path to be exercised.

How to fix it

Apply a Linux kernel update that includes the hid-sony GHL teardown fix: poison the URB first (usb_poison_urb) so in-flight transfers are killed and further submissions are permanently rejected, then drain and block re-arming with timer_shutdown_sync(), and only then free the URB. usb_kill_urb() alone is insufficient because the pending timer could re-submit. If a patched kernel is not yet available, mitigate by not loading hid-sony where GHL dongles are unused (blacklist/unload the module), restricting USB device attach and driver unbind to trusted administrators, and avoiding rmmod of hid-sony while GHL devices may be connected. Reboot into the patched kernel so the in-tree driver is replaced.

How to confirm the fix worked

Confirm the running kernel includes the hid-sony change that calls usb_poison_urb() on ghl_urb before timer_shutdown_sync() on ghl_poke_timer in the remove path, and that usb_free_urb() occurs only after that ordered shutdown. Verify hid-sony is the patched in-tree or distro module (uname -r / package changelog mentioning the GHL timer UAF). On a test system only, bind then unbind a GHL-class device (or a non-production equivalent) and confirm there is no KASAN slab-use-after-free or oops in ghl_magic_poke after teardown. Hosts that never load hid-sony or never attach matching HID dongles are not exposed.

Typical attack path

1. Obtain local code execution or an account that can attach USB devices and trigger hid-sony unbind or module removal
2. Present a GHL-compatible USB HID dongle (or equivalent gadget) so hid-sony probes, allocates sc, and arms ghl_poke_timer / ghl_urb
3. Keep a poke URB in flight so the timer is not pending and timer_delete_sync() during remove is ineffective
4. Trigger driver teardown via disconnect, unbind, or rmmod so sc is freed while the URB/timer lifecycle is still active
5. Allow URB completion to re-arm the timer on the freed sc and wait for the timer softirq to execute ghl_magic_poke against freed kernel memory
6. Turn the resulting use-after-free into denial of service (oops/panic) or further kernel memory corruption for local privilege escalation

How to detect it

This is a local disconnect/rmmod race, so look for evidence after USB unplug, hid-sony unbind, or module unload rather than inbound network traffic. Review kernel logs (dmesg, journal, crash dumps, pstore, kdump/vmcore) for oops, KASAN, or general-protection faults in ghl_magic_poke, call_timer_fn, run_timer_softirq, or hid-sony during remove. Correlate with USB disconnect of vendor 0x1430 product 0x07bb, hid-sony bind/unbind, and rmmod/modprobe of hid-sony. A delay of several seconds between unbind and the timer callback (historically ~8s in the reported reproduction) is consistent with the re-armed poke timer firing on freed memory. There are no public malware families or named threat actors tied to this CVE; treat matching oopses after GHL device removal as suspected exploitation or accidental triggering of the race.

• ghl_magic_poke
• ghl_magic_poke_cb
• ghl_poke_timer
• ghl_urb
• hid-sony
• sony_remove
• sony_probe
• KASAN: slab-use-after-free in ghl_magic_poke
• idVendor=1430
• idProduct=07bb
• VID 0x1430 / PID 0x07bb
• modprobe hid-sony
• rmmod hid-sony
• call_timer_fn
• run_timer_softirq

What your security team should do

• Inventory Linux fleets for kernels that ship hid-sony and for USB attach of GHL-class HID dongles; prioritize patching those hosts
• Deploy vendor or upstream kernels that poison the GHL URB and use timer_shutdown_sync() before freeing driver state; reboot to load the fixed module
• Where patching is delayed, blacklist hid-sony on systems that do not need Guitar Hero Live dongles and restrict USB gadget, unbind, and module-unload capabilities
• Add detection for kernel oopses in ghl_magic_poke / hid-sony during USB disconnect or module remove, and treat unexpected hid-sony unloads as an investigation trigger
• Because this is not KEV and has no known in-the-wild exploit, schedule remediation with other kernel UAFs but do not deprioritize hosts that allow untrusted USB or local unbind