Live › vulnerability › CVE-2026-98500
Go to dashboardIn the Linux HID OneXPlayer driver, device removal cancels delayed work without waiting for running callbacks, so a callback can touch the HID device after it is closed and stopped. The sources describe a use-after-teardown race in the kernel driver and do not say what an attacker can gain from it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the hid-oxp driver loaded, typically OneXPlayer handheld devices. The sources do not say whether the race can be triggered from outside the machine or by an unprivileged user, so exposure beyond the device itself is unknown.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-oxp: use cancel_delayed_work_sync() in remove
oxp_hid_remove() uses cancel_delayed_work() for all three delayed work items. cancel_delayed_work() only dequeues a pending work item without waiting for a currently executing callback to finish. If any of the work callbacks (oxp_rgb_queue_fn, oxp_btn_queue_fn, oxp_mcu_init_fn) is running at the time of removal, the callback continues executing concurrently with hid_hw_close() and hid_hw_stop(), accessing the HID device after it has been closed and stopped.
Use cancel_delayed_work_sync() instead to ensure that any in-progress work callback completes before device teardown proceeds.
This page as .md · .json · in your agent: get_signal("CVE-2026-98500")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.