{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90001 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90001 is a high-severity vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90001 and fix it if it is affected.\n\nWhat it is: CVE-2026-90001 is a high-severity vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90001 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90001/ (Markdown: https://insights.sbomify.com/CVE-2026-90001/index.md)","id":"CVE-2026-90001","markdown":"https://insights.sbomify.com/CVE-2026-90001/index.md","name":"CVE-2026-90001","record":{"aliases":["BELL-CVE-2026-90001","DEBIAN-CVE-2026-90001","GHSA-7wpm-8hvh-3rp4","UBUNTU-CVE-2026-90001"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel HID","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel HID BPF subsystem allows double-freeing a device, potentially leading to memory corruption and privilege escalation.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: serialize device reference release in struct_ops destroy path\n\n__hid_bpf_ops_destroy_device() and hid_bpf_unreg() can race on the\nsame registration reference, double-putting struct hid_device and\nfreeing it while hid_destroy_device() still uses it.  Serialize the\nremove/NULL decision under hdev-\u003ebpf.prog_list_lock so exactly one\npath releases each registration reference: unreg re-checks ops-\u003ehdev\nunder the lock and returns without putting when the destroy path\nalready cleared it; all put_device() calls happen after the lock is\ndropped, which is safe because a concurrent unreg then observes\nops-\u003ehdev == NULL under the lock.\n\nBackground: each successful attach (hid_bpf_ops_reg) acquires one\ndevice reference (hid_get_device()).  Two paths can release it:\n\n- device destruction: hid_destroy_device() -\u003e hid_bpf_destroy_device()\n  -\u003e __hid_bpf_ops_destroy_device(), which walks hdev-\u003ebpf.prog_list\n  under rcu_read_lock() and drops one reference per attached program;\n- BPF link release: bpf map delete (no BPF_F_LINK) synchronously calls\n  st_ops-\u003eunreg() -\u003e hid_bpf_unreg(), which drops the reference for\n  its own registration.\n\nThe coordination handshake (e-\u003ehdev = NULL on the destroy side vs\n\"if (!hdev) return\" on the unreg side) is a TOCTOU check: the two\npaths run under different lock domains (rcu_read_lock vs\nprog_list_lock), so a concurrent unreg can read ops-\u003ehdev as\nnon-NULL, block on prog_list_lock, and then proceed while the\ndestroy traversal executes - both paths then drop the same\nreference.  The refcount reaches zero legitimately (each decrement\nis individually valid), so no refcount_t saturation fires: the\ndevice is simply freed while the transport is still inside\nhid_destroy_device(), and subsequent teardown touches freed memory.\n\nThe fix serializes the remove/NULL decision under prog_list_lock on\nboth sides and moves the destroy-side puts outside the lock.  With\nthe lock held, plain reads/writes of ops-\u003ehdev are sufficient; no\nREAD_ONCE/WRITE_ONCE are added, keeping the patch minimal.\n\nUnlocked-read safety: the unlocked read of ops-\u003ehdev at the top of\nhid_bpf_unreg() cannot touch a freed device, because the unreg path\nitself still holds this registration's reference (released only by\nits own hid_put_device() after the lock is dropped), and a destroy\ntraversal that already cleared ops-\u003ehdev makes the lock-internal\nre-check return early without any put.  At most one of the two\npaths releases each registration reference.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"HID: bpf: serialize device reference release in struct_ops destroy path","id":"CVE-2026-90001","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"ftrace: Take trace_array reference before accessing its ftrace_ops","id":"CVE-2026-90002"},"packages":[],"prev":{"headline":"HID: rmi: fix OOB access with undersized RMI reports","id":"CVE-2026-90000"},"products":["Linux"],"published":"2026-09-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Linux kernel HID BPF subsystem allows double-freeing a device, potentially leading to memory corruption and privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-90001/"}