Linux Kernel Intel HID ACPI Notify Handler Can Run Concurrently on Multiple CPU Cores Since commit e2ffcda16290, Causing Race Conditions in the Hot-Plug Notification Handler

Status: NEW  |  Advisory ID: CVE-2026-64603

Key Details

What to Know

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: intel-hid: Protect ACPI notify handler against recursion

Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on

all CPUs") ACPI notify handlers like the intel-hid notify_handler() may

run on multiple CPU cores racing with themselves.

On convertibles and detachables (matched by DMI chassis-type 31 and 32 in

dmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered

lazily from notify_handler() on the first tablet-mode event, via

intel_hid_switches_setup(). When two such events race on different CPUs

both can pass the !priv->switches check and register the priv->switches

input device twice, resulting in a duplicate sysfs entry and a subsequent

NULL pointer dereference.

This is the same class of bug fixed by commit e075c3b13a0a ("platform/x86:

intel-vbtn: Protect ACPI notify handler against recursion") for the

sibling intel-vbtn driver.

Protect intel-hid notify_handler() from racing with itself with a mutex

to fix this. (NVD)

References