{
  "cveId": "CVE-2026-90001",
  "url": "https://patchblox.com/security/cve/CVE-2026-90001",
  "summary": "CVE-2026-90001 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-90001, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "HID: bpf: serialize device reference release in struct_ops destroy path",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  HID: bpf: serialize device reference release in struct_ops destroy path  __hid_bpf_ops_destroy_device() and hid_bpf_unreg() can race on the same registration reference, double-putting struct hid_device and freeing it while hid_destroy_device() still uses it.  Serialize the remove/NULL decision under hdev-\u003Ebpf.prog_list_lock so exactly one path releases each registration reference: unreg re-checks ops-\u003Ehdev under the lock and returns without putting when the destroy path already cleared it; all put_device() calls happen after the lock is dropped, which is safe because a concurrent unreg then observes ops-\u003Ehdev == NULL under the lock.  Background: each successful attach (hid_bpf_ops_reg) acquires one device reference (hid_get_device()).  Two paths can release it:  - device destruction: hid_destroy_device() -\u003E hid_bpf_destroy_device()   -\u003E __hid_bpf_ops_destroy_device(), which walks hdev-\u003Ebpf.prog_list   under rcu_read_lock() and drops one reference per attached program; - BPF link release: bpf map delete (no BPF_F_LINK) synchronously calls   st_ops-\u003Eunreg() -\u003E hid_bpf_unreg(), which drops the reference for   its own registration.  The coordination handshake (e-\u003Ehdev = NULL on the destroy side vs \u0022if (!hdev) return\u0022 on the unreg side) is a TOCTOU check: the two paths run under different lock domains (rcu_read_lock vs prog_list_lock), so a concurrent unreg can read ops-\u003Ehdev as non-NULL, block on prog_list_lock, and then proceed while the destroy traversal executes - both paths then drop the same reference.  The refcount reaches zero legitimately (each decrement is individually valid), so no refcount_t saturation fires: the device is simply freed while the transport is still inside hid_destroy_device(), and subsequent teardown touches freed memory.  The fix serializes the remove/NULL decision under prog_list_lock on both sides and moves the destroy-side puts outside the lock.  With the lock held, plain reads/writes of ops-\u003Ehdev are sufficient; no READ_ONCE/WRITE_ONCE are added, keeping the patch minimal.  Unlocked-read safety: the unlocked read of ops-\u003Ehdev at the top of hid_bpf_unreg() cannot touch a freed device, because the unreg path itself still holds this registration\u0027s reference (released only by its own hid_put_device() after the lock is dropped), and a destroy traversal that already cleared ops-\u003Ehdev makes the lock-internal re-check return early without any put.  At most one of the two paths releases each registration reference.",
  "published": "2026-09-16T11:17:11Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00175,
  "epssPercentile": 0.07048,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-90001",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.111-1",
      "fix": "DEBIAN-CVE-2026-90001",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90001",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-90001",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90001",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.111-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-90001",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90001",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}