CVE-2026-89626

HID: sensor: custom: Fix field sysfs group cleanup on failure

State: Published
Severity: 8.8 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: sensor: custom: Fix field sysfs group cleanup on failure

hid_sensor_custom_add_attributes() creates one sysfs group for each custom sensor field. If sysfs_create_group() fails after some groups have already been created, the function returns the error without removing the previously created groups.

Add a local unwind path to remove the groups that were already created. With enable_sensor exposed only after the field attributes are ready, this path can free sensor_inst->fields without leaving enable_sensor able to access pointers into that array.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before 416194933af63bd58d03b7605b1ebc1711186838Affected 4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before d0e15091e88d18e30b67daf85b88f6528bb9bf41Affected 4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before 10b05fafff932e325896d59dde40938954ab4577Affected 4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before 2409779f3096fcef41bcf57b5f4887d0fa0dc8ddAffected 4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before 79154fad98ee843e5363940841e2d831503c190aAffected 4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before f3f37b937a6ea2a00fb5e6189e74f855caa43eb5Affected 4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before d96f8958d4469ac02d9c563686cdd968005b944dAffected 4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before 3789d0802ddb4b3be04062caf4bfadd23496e9a7Affected
LinuxLinux	4.1Affected before 4.1Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before 416194933af63bd58d03b7605b1ebc1711186838Affected
4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before d0e15091e88d18e30b67daf85b88f6528bb9bf41Affected
4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before 10b05fafff932e325896d59dde40938954ab4577Affected
4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before 2409779f3096fcef41bcf57b5f4887d0fa0dc8ddAffected
4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before 79154fad98ee843e5363940841e2d831503c190aAffected
4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before f3f37b937a6ea2a00fb5e6189e74f855caa43eb5Affected
4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before d96f8958d4469ac02d9c563686cdd968005b944dAffected
4a7de0519df5e8fb89cef6ee062330ffe4b50a4d to before 3789d0802ddb4b3be04062caf4bfadd23496e9a7Affected

LinuxLinux

4.1Affected
before 4.1Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.