CVE-2026-64595

In the Linux kernel, the following vulnerability has been resolved:

HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove()

hidgocfgprobe() initialises drvdata.gocfg_setup and schedules it to run 2 ms later:

INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup);
schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2));

cfgsetup() dereferences drvdata.hdev to issue MCU command requests. hidgocfgremove() tears down sysfs and stops the HID device, but never drains the delayed work. If the device is unbound within the 2 ms scheduling delay (a probe failure rolling back via remove, or a fast rmmod after probe), the work fires after hiddestroydevice() has dropped its reference and released the underlying hdev struct, leaving cfg_setup() with a stale drvdata.hdev pointer.

Mirror the sibling driver hid-lenovo-go-s.c, whose hidgoscfgremove() already calls canceldelayedworksync() on its analogous work, and drain gocfgsetup at the top of hidgocfgremove(). The cancel must come before guard(mutex)(&drvdata.cfgmutex) because cfg_setup() acquires that mutex; reversing the order would deadlock.