Linux Kernel Vulnerability in Lenovo HID Device Management

CVE-2026-64595

What is CVE-2026-64595?

In the Linux kernel, a vulnerability exists in the HID Lenovo GO driver where the cfg_setup work remains scheduled even when the device is unbound. This can occur within a 2 ms delay, potentially causing cfg_setup to reference a stale pointer after the HID device has been removed. To resolve this issue, it is essential to cancel the delayed work before the mutex guarding the configuration data to prevent a potential deadlock, similar to adjustments made in the sibling driver hid-lenovo-go-s.c.

References