A high-severity use-after-free vulnerability in the Linux kernel HID core, caused by improper device quiescing, poses a significant risk of system instability and potential code execution.

The vulnerability exists in the HID core subsystem where a driver probe failure triggers an improper cleanup sequence. This allows in-flight HID reports to access memory that has already been freed, leading to a use-after-free condition that can be triggered by unauthenticated local users.

Successful exploitation of this flaw can lead to a kernel panic, resulting in unexpected system downtime and service disruption. Furthermore, because the vulnerability involves memory corruption, an attacker may be able to achieve arbitrary code execution within the kernel context, leading to full system compromise and unauthorized access to sensitive data. The CVSS score of 8.8 reflects the high potential for impact on confidentiality, integrity, and availability.

Immediate Action: Update the Linux kernel to version 5.10.270, 5.15.221, 6.1.188, 6.6.157, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation fault errors that occur during hardware peripheral initialization or driver loading processes.

Compensating Controls: Restrict access to physical hardware and USB ports to prevent the connection of unauthorized HID devices that could trigger the vulnerable driver probe paths.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the critical nature of kernel-level vulnerabilities, administrators should prioritize patching these specific kernel versions across all affected infrastructure. While no active exploitation is currently documented, the ability for unauthenticated local users to trigger this state makes it a high-priority update to ensure system stability and security.