CVE-2026-68443hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability. Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba before a855f678ba37ef82c4dd22926ad740ecfb8dbedf; from 42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba before f36e12cc8cfe996d627b8a82bd9df9e43270f6e2; from 42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba before 0842e9faab04f784d01125085195031252ff9695; from 42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba before ff0c5c53d08274e200b48a4d53aa078265e873cb | CNA record |
References
- https://git.kernel.org/stable/c/a855f678ba37ef82c4dd22926ad740ecfb8dbedf
- https://git.kernel.org/stable/c/f36e12cc8cfe996d627b8a82bd9df9e43270f6e2
- https://git.kernel.org/stable/c/0842e9faab04f784d01125085195031252ff9695
- https://git.kernel.org/stable/c/ff0c5c53d08274e200b48a4d53aa078265e873cb
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.