In the Linux kernel, the following vulnerability has been resolved:
HID: amd_sfh: free driver_data after destroying hid device
HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks.
I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output:
[ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479
[ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.2196 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Oct 7, 2024 | Sep 18, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 21, 2024 | Sep 18, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 18, 2024 |
| Suse | — | Upgrade dtb-marvellUpgrade kernel-rtUpgrade dtb-freescaleUpgrade kernel-rt_debug-vdsoUpgrade dtb-broadcomUpgrade kernel-rt-vdsoUpgrade dlm-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-default-develUpgrade kernel-default-baseUpgrade dtb-alteraUpgrade reiserfs-kmp-rtUpgrade kernel-azure-develUpgrade dtb-caviumUpgrade kernel-default-livepatchUpgrade dtb-exynosUpgrade dtb-lgUpgrade dtb-socionextUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-defaultUpgrade dtb-amdUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-rt_debugUpgrade dtb-amazonUpgrade dlm-kmp-rtUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade kernel-debug-vdsoUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-64kbUpgrade kernel-obs-buildUpgrade kernel-syms-rtUpgrade dtb-sprdUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-azureUpgrade kernel-source-rtUpgrade cluster-md-kmp-azureUpgrade dtb-appleUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-sourceUpgrade kernel-64kbUpgrade kernel-azureUpgrade kernel-rt-optionalUpgrade kernel-source-vanillaUpgrade kernel-azure-optionalUpgrade kernel-syms-azureUpgrade reiserfs-kmp-azureUpgrade kernel-symsUpgrade kernel-rt-livepatchUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-64kbUpgrade kernel-rt-develUpgrade dlm-kmp-azureUpgrade kernel-defaultUpgrade cluster-md-kmp-defaultUpgrade dtb-qcomUpgrade dtb-xilinxUpgrade dtb-renesasUpgrade kernel-kvmsmallUpgrade dtb-hisiliconUpgrade dtb-apmUpgrade kernel-zfcpdumpUpgrade dtb-allwinnerUpgrade kselftests-kmp-rtUpgrade dtb-rockchipUpgrade kernel-docsUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade kernel-64kb-develUpgrade kernel-default-optionalUpgrade gfs2-kmp-rtUpgrade dtb-armUpgrade kernel-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-extraUpgrade kernel-debug-develUpgrade dtb-mediatekUpgrade kernel-macrosUpgrade kernel-debugUpgrade dtb-nvidiaUpgrade dtb-amlogicUpgrade reiserfs-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-obs-qaUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-64kb-optional | Dec 5, 2025 | Oct 8, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-gkeUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-5.15.0-1072-awsUpgrade linux-image-oracleUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidiaUpgrade linux-image-awsUpgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-gke-5.15Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1018-oemUpgrade linux-image-oem-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-azure-cvmUpgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1067-nvidiaUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oem-24.04Upgrade linux-image-ibmUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-125-genericUpgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-nvidia-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gkeopUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-oem-22.04cUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-oem-20.04dUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-azureUpgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-intelUpgrade linux-image-intel-iotgUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1078-azureUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-genericUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1069-kvmUpgrade linux-image-nvidia-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-20.04c | Nov 12, 2024 | Sep 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub