Linux Kernel EUVD-2026-80609

Requires local access with the privilege to attach a HID-BPF struct_ops program (CAP_BPF/CAP_SYS_ADMIN, effectively root) to a HID device on a kernel built with HID-BPF support (CONFIG_HID_BPF), version 6.11 through the pre-patch stable releases. The attacker must then win a race between two teardown paths - a BPF map delete (without BPF_F_LINK) invoking hid_bpf_unreg() and simultaneous device destruction via hid_destroy_device() - so both drop the same registration reference. Limiting factors: root-equivalent privilege is already needed, the timing window is narrow (AC:H), and the outcome is a crash rather than code execution or data disclosure. Not exploitable remotely and not against a default configuration without HID-BPF programs in use.

The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) materially overstates real-world risk. This is a TOCTOU race/double-free (CWE-416/362): the device-destroy path (__hid_bpf_ops_destroy_device, walking hdev->bpf.prog_list under rcu_read_lock) and the BPF-link-release path (hid_bpf_unreg via st_ops->unreg) can each drop the SAME single hid_get_device() registration reference under different lock domains, freeing struct hid_device while hid_destroy_device() still uses it. Two CVSS metrics are inflated: (1) AC:L is wrong - exploitation requires winning a tight timing window between concurrent HID-BPF struct_ops teardown and device destruction, which is AC:H; (2) PR:L understates the barrier - attaching a HID-BPF struct_ops program requires CAP_BPF/CAP_SYS_ADMIN, i.e. effectively root (PR:H). The impact is also mis-set: the refcount legitimately reaches zero (each decrement is individually valid, no refcount_t saturation fires), producing a use-after-free that manifests as memory corruption and crash - a denial-of-service, not the confidentiality/integrity loss implied by C:H/I:H. No EPSS, no KEV, and no public POC accompany this record. Net: a genuine but low-priority local root DoS, not the high-severity issue the raw score suggests.

A local attacker who already holds CAP_BPF/CAP_SYS_ADMIN attaches a HID-BPF struct_ops program to a HID device, then triggers a BPF map delete (without BPF_F_LINK) to invoke hid_bpf_unreg() at the exact moment the device is being destroyed (e.g. by unplugging or unbinding). If the race is won, both paths put_device() the same registration reference, freeing the hid_device mid-teardown and causing a use-after-free that panics the kernel. No public exploit code is identified at time of analysis, and success depends on hitting a narrow timing window.