{"id":"CVE-2026-98500","kind":"vulnerability","aliases":["CVE-2026-98500"],"related":[],"title":"Linux kernel: HID OneXPlayer driver races work callbacks during device removal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-oxp: use cancel_delayed_work_sync() in remove\n\noxp_hid_remove() uses cancel_delayed_work() for all three delayed work\nitems.  cancel_delayed_work() only dequeues a pending work item without\nwaiting for a currently executing callback to finish.  If any of the\nwork callbacks (oxp_rgb_queue_fn, oxp_btn_queue_fn, oxp_mcu_init_fn) is\nrunning at the time of removal, the callback continues executing\nconcurrently with hid_hw_close() and hid_hw_stop(), accessing the HID\ndevice after it has been closed and stopped.\n\nUse cancel_delayed_work_sync() instead to ensure that any in-progress\nwork callback completes before device teardown proceeds.","summary":"In the Linux HID OneXPlayer driver, device removal cancels delayed work without waiting for running callbacks, so a callback can touch the HID device after it is closed and stopped. The sources describe a use-after-teardown race in the kernel driver and do not say what an attacker can gain from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hid-oxp","infrastructure","linux-kernel","onexplayer"],"not_affected_if":["hid-oxp-driver-not-loaded"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel build that includes the upstream commit replacing cancel_delayed_work() with cancel_delayed_work_sync() in oxp_hid_remove() (hid-oxp driver).","status":"open","published_at":"2026-10-18T16:17:01+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:34+00:00","updated_at":"2026-10-25T05:25:34+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:25:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel build that includes the upstream commit replacing cancel_delayed_work() with cancel_delayed_work_sync() in oxp_hid_remove() (hid-oxp driver).","reach":"local","title":"Linux kernel: HID OneXPlayer driver races work callbacks during device removal","impact":"low","summary":"In the Linux HID OneXPlayer driver, device removal cancels delayed work without waiting for running callbacks, so a callback can touch the HID device after it is closed and stopped. The sources describe a use-after-teardown race in the kernel driver and do not say what an attacker can gain from it.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","hid-oxp","onexplayer"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources describe a race during device removal only","analyst_note":"Check the upstream kernel commit and NVD entry for CVSS, trigger conditions, and affected kernel versions; the sources give none of these.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["hid-oxp-driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the hid-oxp driver loaded, typically OneXPlayer handheld devices. The sources do not say whether the race can be triggered from outside the machine or by an unprivileged user, so exposure beyond the device itself is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000622,"input_tokens":3498,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98500':14A,17A 'access':168C 'attack':75B 'btn':141C 'callback':8A,41B,44B,127C,135C,156C,193C 'cancel':34B,93C,103C,112C,180C 'close':53B,163C,176C 'complet':194C 'concurr':159C 'continu':157C 'current':125C 'cve':12A,15A 'delay':35B,94C,104C,109C,113C,181C 'dequeu':116C 'describ':58B 'devic':10A,32B,49B,171C,196C 'driver':5A,31B,68B 'ensur':186C 'execut':126C,158C 'finish':129C 'fn':139C,143C,147C 'follow':83C 'gain':77B 'hid':3A,19B,29B,48B,88C,90C,100C,161C,165C,170C 'hid-oxp':18B,89C 'hw':162C,166C 'in-progress':189C 'infrastructur':21B 'init':146C 'instead':184C 'item':111C,120C 'kernel':2A,24B,67B,81C 'linux':1A,23B,28B,80C 'linux-kernel':22B 'mcu':145C 'onexplay':4A,25B,30B 'oxp':20B,91C,99C,136C,140C,144C 'pend':118C 'proceed':198C 'progress':191C 'queue':138C,142C 'race':6A,64B 'remov':11A,33B,98C,101C,154C 'resolv':87C 'rgb':137C 'run':40B,149C 'say':72B 'sourc':57B 'stop':55B,167C,178C 'sync':96C,183C 'teardown':63B,197C 'three':108C 'time':152C 'touch':46B 'use':61B,92C,102C,179C 'use-after-teardown':60B 'vulner':84C 'wait':38B,122C 'without':37B,121C 'work':7A,36B,95C,105C,110C,114C,119C,134C,182C,192C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the hid-oxp driver loaded, typically OneXPlayer handheld devices. The sources do not say whether the race can be triggered from outside the machine or by an unprivileged user, so exposure beyond the device itself is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98500","severity":null,"published_at":"2026-10-18T16:17:01+00:00","modified_at":"2026-10-19T10:19:03+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}