{"id":"CVE-2026-80767","summary":"HID: sensor: custom: Fix use-after-free in enable_sensor","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: sensor: custom: Fix use-after-free in enable_sensor\n\nenable_sensor_store() can call set_power_report_state(), which\ndereferences sensor_inst-\u003epower_state and sensor_inst-\u003ereport_state.\nThese pointers refer to entries in sensor_inst-\u003efields.\n\nCreate the field attributes before exposing the enable_sensor sysfs\nattribute, so enable_sensor cannot be accessed before the state it\ndepends on has been initialized.\n\nOn remove, delete enable_sensor before freeing the field attributes,\nso a concurrent sysfs write cannot dereference freed memory through\npower_state or report_state.","modified":"2026-09-06T03:46:44.828718788Z","published":"2026-09-04T15:12:39.363Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80767.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/244a1cb638370490ed74a8adb5cc3f1212602e32"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2ce90cfc6646a32100feabd7110ae0352aa01167"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7bb79a3cf45e0805aef74457e19deb77e18cf196"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8406d4b69d48bc72fb6f8812a65a17a1f903440b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ad8fb82b04422f49530d2aa2753cc81d1c60102c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c0757f10610542d763bd0bf9bda455b78afeef0b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c2be74b0272b7f8f60739e7aaf0d36c0befe7136"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d37ff4e3635c18af907f25712596f8ccec323751"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d7cbea1d342a16ec96d9eb3d7bd0ba2d4b2f2855"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80767.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80767"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4a7de0519df5e8fb89cef6ee062330ffe4b50a4d"},{"fixed":"c2be74b0272b7f8f60739e7aaf0d36c0befe7136"},{"fixed":"d7cbea1d342a16ec96d9eb3d7bd0ba2d4b2f2855"},{"fixed":"d37ff4e3635c18af907f25712596f8ccec323751"},{"fixed":"2ce90cfc6646a32100feabd7110ae0352aa01167"},{"fixed":"244a1cb638370490ed74a8adb5cc3f1212602e32"},{"fixed":"8406d4b69d48bc72fb6f8812a65a17a1f903440b"},{"fixed":"c0757f10610542d763bd0bf9bda455b78afeef0b"},{"fixed":"7bb79a3cf45e0805aef74457e19deb77e18cf196"},{"fixed":"ad8fb82b04422f49530d2aa2753cc81d1c60102c"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80767.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"5.10.267"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.218"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.185"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.154"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.106"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.47"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0"},{"fixed":"7.2.1"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80767.json"}}],"schema_version":"1.9.0"}