Linux HID/amd_sfh - driver_data freed after HID device destruction: A use-after-free in the AMD Sensor Fusion Hub HID

Impact

A use-after-free in the AMD Sensor Fusion Hub HID driver: driver_data is freed in the wrong order relative to hid_destroy_device(), so callbacks touch memory that is already gone. Kernel UAF is a privilege-escalation primitive. AMD SFH is a client-platform driver and unlikely to be loaded on an Instinct server - but it is compiled into stock distro kernels, and a driver that is present but unneeded is attack surface you are carrying for nothing.

Who can reach it

Local, on hosts where the amd_sfh driver is loaded.

What to do

Fixed in the Linux kernel; take the distro update and reboot. Better: blacklist amd_sfh on server images. Auditing your GPU nodes for client-platform drivers that autoload and are never used is a cheap one-off that shrinks the kernel attack surface permanently.

References