CVE-2026-64362 HID: lg-g15: cancel pending work on remove to fix a use-after-free
A use-after-free in the Linux kernel lg-g15 HID driver allows attackers to cause denial of service or execute code via a race condition during device unplug.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64362?
CVE-2026-64362 is a high-severity use after free vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: lg-g15: cancel pending work on remove to fix a use-after-free
lg_g15_data is allocated with devm and holds a work item. The report handlers schedule that work straight from device input. lg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key, and lg_g510_leds_event() does it too. The worker dereferences the lg_g15_data back through container_of.
The driver had no remove callback and never cancelled the work. So if a report scheduled the work and the keyboard was then unplugged, devres freed lg_g15_data while the work was still pending or running, and the worker touched freed memory. This is a use-after-free. It is reachable as a race on device unplug.
Add a remove callback that cancels the work before devres frees the state. g15->work is only initialized for the models that schedule it (G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the cancel on g15->work.func to avoid cancelling a work that was never set up. The g15 NULL test mirrors the one already in lg_g15_raw_event().
Weakness: CWE-416
Which versions are affected by CVE-2026-64362?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64362?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-64362 being exploited?
There is no known exploitation of CVE-2026-64362 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93776, BELL-CVE-2026-64362, DEBIAN-CVE-2026-64362, GHSA-6q43-gp6v-hqmf, ROOT-OS-UBUNTU-2204-CVE-2026-64362, UBUNTU-CVE-2026-64362.