CVE-2026-64362: HID: lg-g15: cancel pending work on remove to fix a use-after-free

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

HID: lg-g15: cancel pending work on remove to fix a use-after-free

lg_g15_data is allocated with devm and holds a work item. The report
handlers schedule that work straight from device input.
lg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key,
and lg_g510_leds_event() does it too. The worker dereferences the
lg_g15_data back through container_of.

The driver had no remove callback and never cancelled the work. So if a
report scheduled the work and the keyboard was then unplugged, devres
freed lg_g15_data while the work was still pending or running, and the
worker touched freed memory. This is a use-after-free. It is reachable
as a race on device unplug.

Add a remove callback that cancels the work before devres frees the
state. g15->work is only initialized for the models that schedule it
(G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the
cancel on g15->work.func to avoid cancelling a work that was never set
up. The g15 NULL test mirrors the one already in lg_g15_raw_event().

The Linux kernel CVE team has assigned CVE-2026-64362 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.5 with commit 97b741aba918c4143f4208d2421d08ff215c1b49 and fixed in 5.10.261 with commit 3b9a3919aac6977262f04d5365c0456877522a44
	Issue introduced in 5.5 with commit 97b741aba918c4143f4208d2421d08ff215c1b49 and fixed in 5.15.212 with commit 4aef9676c26dff8723b56834951cfc6b618f0986
	Issue introduced in 5.5 with commit 97b741aba918c4143f4208d2421d08ff215c1b49 and fixed in 6.1.178 with commit acce9dee807f21184fff19ad17c8ed464247e7f7
	Issue introduced in 5.5 with commit 97b741aba918c4143f4208d2421d08ff215c1b49 and fixed in 6.6.145 with commit 33cd1a000daf929356aacf2b191d31714ff0615e
	Issue introduced in 5.5 with commit 97b741aba918c4143f4208d2421d08ff215c1b49 and fixed in 6.12.96 with commit dfc6e61f83113cc18346b6988f07271c0063357d
	Issue introduced in 5.5 with commit 97b741aba918c4143f4208d2421d08ff215c1b49 and fixed in 6.18.39 with commit 4d0d51bc12d246accbfbb94de05d729c68c9b8fb
	Issue introduced in 5.5 with commit 97b741aba918c4143f4208d2421d08ff215c1b49 and fixed in 7.1.4 with commit 8131f4226688c4be5f30874d167e44dab838eb09
	Issue introduced in 5.5 with commit 97b741aba918c4143f4208d2421d08ff215c1b49 and fixed in 7.2-rc3 with commit 7705b4140d188ce22656f6e541ae7ef834c7e11a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64362
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hid/hid-lg-g15.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3b9a3919aac6977262f04d5365c0456877522a44
	https://git.kernel.org/stable/c/4aef9676c26dff8723b56834951cfc6b618f0986
	https://git.kernel.org/stable/c/acce9dee807f21184fff19ad17c8ed464247e7f7
	https://git.kernel.org/stable/c/33cd1a000daf929356aacf2b191d31714ff0615e
	https://git.kernel.org/stable/c/dfc6e61f83113cc18346b6988f07271c0063357d
	https://git.kernel.org/stable/c/4d0d51bc12d246accbfbb94de05d729c68c9b8fb
	https://git.kernel.org/stable/c/8131f4226688c4be5f30874d167e44dab838eb09
	https://git.kernel.org/stable/c/7705b4140d188ce22656f6e541ae7ef834c7e11a