CVE-2026-89626

The Linux kernel's HID sensor custom driver (hid-sensor-custom) mishandles failure in hid_sensor_custom_add_attributes(): if sysfs_create_group() fails after some per-field attribute groups were already created, the function returns without removing them, and the driver can free sensor_inst->fields while the previously exposed enable_sensor attribute can still reach pointers into that freed array, creating a use-after-free of kernel memory. The bug is triggered when attribute creation fails partway through enumeration of a custom HID sensor's fields, a condition most plausibly induced by a faulty or malicious HID sensor device (attack vector is adjacent, e.g. HID over Bluetooth/USB). Successful exploitation could yield kernel memory corruption with high confidentiality, integrity, and availability impact, potentially enabling privilege escalation or a system crash. Affected systems are those running kernels that ship the vulnerable code path with the HID sensor custom driver enabled, which is common on laptops and convertibles with HID sensor hubs. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Update to a kernel release or distro backport containing the fix for hid_sensor_custom_add_attributes() and monitor your vendor's stable kernel advisories. On hardware without HID custom sensors, blacklist or prevent auto-loading of the hid_sensor_custom module (verify with 'lsmod | grep hid_sensor_custom' and the presence of an enable_sensor attribute under /sys) to eliminate the vulnerable path until patched.