CVE-2026-93189

HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

State: Published
Severity: 8.8 High
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

A driver's probe calls hid_device_io_start() to enable input delivery, then fails at a later initialization step and unwinds via hid_hw_stop(). The unwind frees struct hidraw via hidraw_disconnect() while in-flight HID reports may still be running on another CPU, dereferencing the freed object through hidraw_report_event(). syzbot reports the resulting use-after-free for the corsair-psu HID driver.

Edward Adam Davis posted a per-driver fix for corsair-psu that adds an explicit hid_device_io_stop() before hid_hw_stop() in the probe error path ("hwmon: prevent packets from going to driver for probe", 2026-04-28). Auditing the tree shows 15 drivers call hid_device_io_start(); 7 also call hid_device_io_stop() and 8 do not:

drivers calling hid_device_io_start() without a matching hid_device_io_stop() before hid_hw_stop(): drivers/hwmon/corsair-psu.c (fix posted by Edward) drivers/hwmon/corsair-cpro.c drivers/hwmon/nzxt-kraken3.c drivers/hwmon/nzxt-smart2.c drivers/hwmon/gigabyte_waterforce.c drivers/hid/hid-logitech-dj.c drivers/hid/hid-nintendo.c drivers/hid/hid-mcp2221.c

Roughly half of all callers of the API are exposed. Centralize the quiesce in hid_hw_stop() so callers do not have to remember the matching stop: if a driver has left hdev->io_started true on entry, call hid_device_io_stop() before hid_disconnect().

For the 7 drivers that already call hid_device_io_stop() correctly, hdev->io_started is false on entry, the guard short-circuits, and behavior is unchanged.

No Fixes: tag because the affected drivers gained their hid_device_io_start() calls independently over years; the bug is a class-wide API misuse rather than a regression from one commit.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0744cb9520aade37e78f69134f3111086158f1d2Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c876c437d188911685d8bed645416f2e86bd0354Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6787f1828f5616f17250e108c0031fb96fd2cfe6Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 92cca302a4eaf65d1b38b3fb600b4ee5eb856a51Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 02246d8b462fd9bd90bc7ae7d6cab1acf69bcb87Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 544ebb25bd58f67e821573412ab7a982b9e02211Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0fecd89f979a8653b9a5b0816570329b7a94a081Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a4bc41504690b7d7064931909874f5b98cd148b6Affected before 5.10.270Affected before 5.15.221Affected before 6.1.188Affected before 6.6.157Affected before 6.12.110Affected before 6.18.52Affected before 7.2.6Affected
LinuxLinux	5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0744cb9520aade37e78f69134f3111086158f1d2Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c876c437d188911685d8bed645416f2e86bd0354Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6787f1828f5616f17250e108c0031fb96fd2cfe6Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 92cca302a4eaf65d1b38b3fb600b4ee5eb856a51Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 02246d8b462fd9bd90bc7ae7d6cab1acf69bcb87Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 544ebb25bd58f67e821573412ab7a982b9e02211Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0fecd89f979a8653b9a5b0816570329b7a94a081Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a4bc41504690b7d7064931909874f5b98cd148b6Affected
before 5.10.270Affected
before 5.15.221Affected
before 6.1.188Affected
before 6.6.157Affected
before 6.12.110Affected
before 6.18.52Affected
before 7.2.6Affected

LinuxLinux

5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.