CVE-2026-80767
In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enable_sensor enable_sensor_store() can call set_power_report_state(), which dereferences sensor_inst->power_state and sensor_inst->report_state. These pointers refer to entries in sensor_inst->fields. Create the field attributes before exposing the enable_sensor sysfs attribute, so enable_sensor cannot be accessed before the state it depends on has been initialized. On remove, delete enable_sensor before freeing the field attributes, so a concurrent sysfs write cannot dereference freed memory through power_state or report_state.
Affected versions
Linux kernel versions
4.1
and later are affected. Fixed in
5.10.267,
5.15.218,
6.1.185,
6.6.154,
6.12.106,
6.18.47,
7.1.11,
7.2.1,
7.3
and their respective stable series.
References
9 totalFrequently asked questions
-
What is CVE-2026-80767?
CVE-2026-80767 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.1 onward and has been patched in 5.10.267, 5.15.218, 6.1.185 and others. CVE-2026-80767 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-80767?
Yes. CVE-2026-80767 has been patched. Fixed versions include 5.10.267, 5.15.218, 6.1.185 and others. If you are running Linux kernel 4.1 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-80767 actively exploited?
No. CVE-2026-80767 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.