{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89625 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89625 is an use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89625 and fix it if it is affected.\n\nWhat it is: CVE-2026-89625 is an use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89625 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89625/ (Markdown: https://insights.sbomify.com/CVE-2026-89625/index.md)","id":"CVE-2026-89625","markdown":"https://insights.sbomify.com/CVE-2026-89625/index.md","name":"CVE-2026-89625","record":{"aliases":["AZL-100494","BELL-CVE-2026-89625","DEBIAN-CVE-2026-89625","GHSA-h5c7-p475-c26r","UBUNTU-CVE-2026-89625"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel HID driver","requires_auth":"none","summary":"A use-after-free in the Linux kernel HID sony driver allows local attackers to execute code or escalate privileges via a race condition during device unbind.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind\n\nFor GHL (Guitar Hero Live) dongles, sony_probe() arms a periodic timer:\nghl_magic_poke() (the timer callback) submits sc-\u003eghl_urb, and the URB\ncompletion ghl_magic_poke_cb() re-arms the timer with mod_timer().\n\nsony_remove() drained the timer with timer_delete_sync() and then freed\nthe URB with usb_free_urb():\n\n\ttimer_delete_sync(\u0026sc-\u003eghl_poke_timer);\n\tusb_free_urb(sc-\u003eghl_urb);\n\ntimer_delete_sync() does not block re-arming, and while the URB is in\nflight the timer is not pending, so the sync delete is a no-op. A URB\ncompletion that runs after the delete re-arms the timer, and usb_free_urb()\nonly drops a reference -- it does not kill an in-flight URB. sc is\nallocated with devm_kzalloc() and freed once sony_remove() returns, so the\nre-armed ghl_poke_timer (embedded in sc) then fires on freed memory, a\nuse-after-free from timer softirq. This is a disconnect/rmmod race.\n\nPoison the URB first, then shut the timer down, before freeing the URB.\nusb_poison_urb() kills any in-flight URB and permanently rejects further\nsubmissions, so a poke timer that is still pending cannot re-submit the\nURB from ghl_magic_poke() in the window before timer_shutdown_sync() runs.\nusb_kill_urb() would not suffice: it only cancels the in-flight URB and\nleaves it submittable once it returns, so the pending timer could\nre-submit it and put a fresh URB in flight over the freed sc.\ntimer_shutdown_sync() then drains any last callback and blocks re-arming.\nThe probe error path is unaffected: it is only reached before the timer\nis armed.\n\nReproduced under KASAN on next-20260710 via dummy_hcd + raw-gadget\nemulation of the GHL PS4 dongle (VID 0x1430 / PID 0x07bb): hid-sony binds\nand arms the poke timer, the poke URB is held in flight, the driver is\nunbound (freeing sc), then the URB is released. The completion re-arms the\ntimer on the freed sc, and the re-armed timer fires ~8 s later:\n\n  BUG: KASAN: slab-use-after-free in ghl_magic_poke+0x98/0xb0\n  Read of size 8 at addr ffff88810b02fd50 by task swapper/0/0\n   ghl_magic_poke+0x98/0xb0\n   call_timer_fn+0x35/0x2b0\n   __run_timers+0x69c/0x9a0\n   run_timer_softirq+0x173/0x2a0\n  Allocated by task 169:  sony_probe\n  Freed by task 338:      devres_release_group \u003c- hid_device_remove (sony_remove)\n\nFound by 0sec (https://0sec.ai) using automated source analysis.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind","id":"CVE-2026-89625","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"HID: sensor: custom: Fix field sysfs group cleanup on failure","id":"CVE-2026-89626"},"packages":[],"prev":{"headline":"HID: universal-pidff: stop the device when force-feedback init fails","id":"CVE-2026-89624"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel HID sony driver allows local attackers to execute code or escalate privileges via a race condition during device unbind.","url":"https://insights.sbomify.com/CVE-2026-89625/"}