CVE-2026-68360

hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Aug 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop

Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.

Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 3df2b67793babbea7951b5f601d6df891c63b5d8Affected 40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 5e07f292ab5591bf4f588aa7abd22ec86c25d076Affected 40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 6c5f31fdf28455a7fd573bda452c80b7b6700247Affected 40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 0975c42ed2a3bf32125a920e5d19194289126210Affected 40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before c7757db58957ac20cdec6ce575dbd44a6375664eAffected 40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 56d2deb6448378118dbe68c4fbb3fbae5f65b18cAffected 40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 1a634f464d6153dfa4d7e73a3d78236b65a64ee9Affected 40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 94c87871b051d7ad758828a805215a2ec194512aAffected
LinuxLinux	5.9Affected before 5.9Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 3df2b67793babbea7951b5f601d6df891c63b5d8Affected
40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 5e07f292ab5591bf4f588aa7abd22ec86c25d076Affected
40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 6c5f31fdf28455a7fd573bda452c80b7b6700247Affected
40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 0975c42ed2a3bf32125a920e5d19194289126210Affected
40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before c7757db58957ac20cdec6ce575dbd44a6375664eAffected
40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 56d2deb6448378118dbe68c4fbb3fbae5f65b18cAffected
40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 1a634f464d6153dfa4d7e73a3d78236b65a64ee9Affected
40c3a445422579db8ad96c234dbe6c0ab3f6b936 to before 94c87871b051d7ad758828a805215a2ec194512aAffected

LinuxLinux

5.9Affected
before 5.9Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.