CVE-2026-80767 HID: sensor: custom: Fix use-after-free in enable_sensor
A use-after-free vulnerability in the Linux kernel HID sensor driver allows local attackers to execute arbitrary code or escalate privileges via sysfs writes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80767?
CVE-2026-80767 is an use after free vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: sensor: custom: Fix use-after-free in enable_sensor
enable_sensor_store() can call set_power_report_state(), which dereferences sensor_inst->power_state and sensor_inst->report_state. These pointers refer to entries in sensor_inst->fields.
Create the field attributes before exposing the enable_sensor sysfs attribute, so enable_sensor cannot be accessed before the state it depends on has been initialized.
On remove, delete enable_sensor before freeing the field attributes, so a concurrent sysfs write cannot dereference freed memory through power_state or report_state.
Which versions are affected by CVE-2026-80767?
How do I fix CVE-2026-80767?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-80767 being exploited?
There is no known exploitation of CVE-2026-80767 in the wild and no public exploit code.
Sources
Also known as AZL-99500, BELL-CVE-2026-80767, DEBIAN-CVE-2026-80767, GHSA-hxq5-9fvr-38r3, UBUNTU-CVE-2026-80767.