Re: [BUG] drivers/hid: use-after-free in u2fzero_recv()

[Jiri Kosina]

On Thu, 27 Aug 2026, co wrote:

> We found a bug reachable in:
> 
>     path    drivers/hid
>     crash   use-after-free in u2fzero_recv()
>     commit  6f232446a629 ("Linux 6.12.77")
> 
> Config, environment, the sanitizer report and a C reproducer follow.
> 
> == Notes ===============================================================
>     If you patch the bug based on our artifacts, a tag would be
>     appreciated:
> 
> Reported-by: co+b240dc164119a46c@xxxxxxx
> 
>     Everything in this mail is validated by the reproducer below.
> 
>     We also hold an LLM-generated root-cause analysis and a candidate
>     patch. The patch passes an A/B test: the same reproducer panics the
>     unpatched kernel and runs clean on the patched one. Neither has had
>     human review, so both still require validation before you send or
>     apply them. Available on:
> 
>         patch.diff  https://bugs.sh/b/b240dc164119a46c/patch.diff
>         report.md   https://bugs.sh/b/b240dc164119a46c/report.md
> 
>     This is an open science project. The code and the full set of PoCs
>     are not public at this moment, as we intend to disclose our findings
>     in an ethical way.
> 
>     Happy to test patches. Complaints and suggestions about our work
>     are welcome at:
> 

Could you please submit this as a proper patch [1] so that you can 
properly creditted for the fix?

Thanks.

[1] Documentation/process/submitting-patches.rst

-- 
Jiri Kosina
SUSE Labs