In the Linux kernel, the following vulnerability has been resolved:
HID: amd_sfh: free driver_data after destroying hid device
HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks.
I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output:
[ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479
[ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.2196 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | Oct 7, 2024 | Sep 18, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 21, 2024 | Sep 18, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 18, 2024 |
| Suse | — | Upgrade dtb-amdUpgrade reiserfs-kmp-64kbUpgrade dtb-sprdUpgrade kernel-syms-rtUpgrade dtb-lgUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-source-azureUpgrade dtb-socionextUpgrade kernel-obs-buildUpgrade kernel-source-rtUpgrade kernel-debug-livepatch-develUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-64kb-extraUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade dtb-alteraUpgrade kernel-rt-optionalUpgrade kernel-64kbUpgrade kernel-azureUpgrade kernel-azure-extraUpgrade kernel-source-vanillaUpgrade ocfs2-kmp-64kbUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade kernel-azure-vdsoUpgrade kernel-rt_debugUpgrade kernel-rt-vdsoUpgrade kernel-default-baseUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade dtb-caviumUpgrade kernel-azure-develUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-develUpgrade cluster-md-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade dtb-broadcomUpgrade dtb-freescaleUpgrade kernel-rt_debug-vdsoUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-rtUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade dtb-amazonUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-optionalUpgrade dtb-marvellUpgrade kselftests-kmp-azureUpgrade dtb-appleUpgrade kernel-64kb-develUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-rtUpgrade kernel-docsUpgrade dtb-allwinnerUpgrade dtb-nvidiaUpgrade reiserfs-kmp-defaultUpgrade kernel-debugUpgrade dtb-xilinxUpgrade dtb-qcomUpgrade cluster-md-kmp-defaultUpgrade dtb-renesasUpgrade kernel-kvmsmall-develUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-rtUpgrade kernel-debug-develUpgrade dtb-mediatekUpgrade ocfs2-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-kvmsmallUpgrade kernel-defaultUpgrade kernel-rt-develUpgrade kernel-default-optionalUpgrade kernel-64kb-optionalUpgrade kernel-devel-rtUpgrade kernel-default-extraUpgrade dlm-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-default-vdsoUpgrade kernel-devel-azureUpgrade reiserfs-kmp-azureUpgrade kernel-symsUpgrade dtb-hisiliconUpgrade dtb-armUpgrade kernel-develUpgrade kernel-64kb-livepatch-develUpgrade dtb-apmUpgrade dtb-amlogicUpgrade kernel-default-livepatch-develUpgrade dtb-rockchip | Dec 5, 2025 | Oct 8, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-kvmUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-oem-22.04cUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-oem-20.04dUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-gkeop-5.15Upgrade linux-image-genericUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-generic-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-intelUpgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-nvidia-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-azureUpgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-raspiUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1069-kvmUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-5.15.0-1067-nvidiaUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-gkeUpgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-awsUpgrade linux-image-oem-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-ibm-classicUpgrade linux-image-azure-cvmUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-virtualUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-125-genericUpgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-aws-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1072-awsUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-ibmUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1018-oemUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-oracle | Nov 12, 2024 | Sep 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub