Re: [BUG] drivers/hid: use-after-free in u2fzero_recv()

[CO]

On Fri, Sep 11, 2026 at 7:54 AM Jiri Kosina <jikos@xxxxxxxxxx> wrote:
>
> On Thu, 27 Aug 2026, co wrote:
>
> > We found a bug reachable in:
> >
> >     path    drivers/hid
> >     crash   use-after-free in u2fzero_recv()
> >     commit  6f232446a629 ("Linux 6.12.77")
> >
> > Config, environment, the sanitizer report and a C reproducer follow.
> >
> > == Notes ===============================================================
> >     If you patch the bug based on our artifacts, a tag would be
> >     appreciated:
> >
> > Reported-by: co+b240dc164119a46c@xxxxxxx
> >
> >     Everything in this mail is validated by the reproducer below.
> >
> >     We also hold an LLM-generated root-cause analysis and a candidate
> >     patch. The patch passes an A/B test: the same reproducer panics the
> >     unpatched kernel and runs clean on the patched one. Neither has had
> >     human review, so both still require validation before you send or
> >     apply them. Available on:
> >
> >         patch.diff  https://bugs.sh/b/b240dc164119a46c/patch.diff
> >         report.md   https://bugs.sh/b/b240dc164119a46c/report.md
> >
> >     This is an open science project. The code and the full set of PoCs
> >     are not public at this moment, as we intend to disclose our findings
> >     in an ethical way.
> >
> >     Happy to test patches. Complaints and suggestions about our work
> >     are welcome at:
> >
>
> Could you please submit this as a proper patch [1] so that you can
> properly creditted for the fix?
>
Hi Jiri,

Thanks for your suggestions. We are sorry for the misleading report. We
have updated the report format so that it is correctly stated as a bug
report, not a patch. We will also state that the provided patch is
LLM-agent-generated. We do not want to overwhelm the maintainers with
low-quality patches, so we choose to send the bug report, and we will
spend our time working with other contributors to close these bug
reports. This is mainly because our bug discovery is automated, but
patch verification is hard and cannot be done reliably by an LLM. So we
decided to report the low-severity bugs like syzbot and ask the
community for help.

We could provide the patch in ready-to-send format, but we worry about
people sending it on without review, so we trimmed it and kept only the
code change.

Feel free to tell us if you have any suggestions for our workflow.

Xiang

> Thanks.
>
> [1] Documentation/process/submitting-patches.rst
>
> --
> Jiri Kosina
> SUSE Labs
>
>