High 8.8Published Sep 17, 2026

CVE-2026-93189HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

Updated under an hour ago (2026-10-19 08:00 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: HID: core: quiesce input in hid_hw_stop() to prevent use-after-free A driver's probe calls hid_device_io_start() to enable input delivery, then fails at a later initialization step and unwinds via hid_hw_stop(). The unwind frees struct hidraw via hidraw_disconnect() while in-flight HID reports may still be running on another CPU, dereferencing the freed object through hidraw_report_event(). syzbot reports the resulting use-after-free for the corsair-psu HID driver. Edward Adam Davis posted a per-driver fix for corsair-psu that adds an explicit hid_device_io_stop() before hid_hw_stop() in the probe error path ("hwmon: prevent packets from going to driver for probe", 2026-04-28). Auditing the tree shows 15 drivers call hid_device_io_start(); 7 also call hid_device_io_stop() and 8 do not: drivers calling hid_device_io_start() without a matching hid_device_io_stop() before hid_hw_stop(): drivers/hwmon/corsair-psu.c (fix posted by Edward) drivers/hwmon/corsair-cpro.c drivers/hwmon/nzxt-kraken3.c drivers/hwmon/nzxt-smart2.c drivers/hwmon/gigabyte_waterforce.c drivers/hid/hid-logitech-dj.c drivers/hid/hid-nintendo.c drivers/hid/hid-mcp2221.c Roughly half of all callers of the API are exposed. Centralize the quiesce in hid_hw_stop() so callers do not have to remember the matching stop: if a driver has left hdev->io_started true on entry, call hid_device_io_stop() before hid_disconnect(). For the 7 drivers that already call hid_device_io_stop() correctly, hdev->io_started is false on entry, the guard short-circuits, and behavior is unchanged. No Fixes: tag because the affected drivers gained their hid_device_io_start() calls independently over years; the bug is a class-wide API misuse rather than a regression from one commit.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Sep 18, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 0744cb9520aade37e78f69134f3111086158f1d2; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c876c437d188911685d8bed645416f2e86bd0354; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6787f1828f5616f17250e108c0031fb96fd2cfe6; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 92cca302a4eaf65d1b38b3fb600b4ee5eb856a51; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 02246d8b462fd9bd90bc7ae7d6cab1acf69bcb87; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 544ebb25bd58f67e821573412ab7a982b9e02211; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 0fecd89f979a8653b9a5b0816570329b7a94a081; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a4bc41504690b7d7064931909874f5b98cd148b6; and 7 more ranges	CNA record

References

https://git.kernel.org/stable/c/0744cb9520aade37e78f69134f3111086158f1d2
https://git.kernel.org/stable/c/c876c437d188911685d8bed645416f2e86bd0354
https://git.kernel.org/stable/c/6787f1828f5616f17250e108c0031fb96fd2cfe6
https://git.kernel.org/stable/c/92cca302a4eaf65d1b38b3fb600b4ee5eb856a51
https://git.kernel.org/stable/c/02246d8b462fd9bd90bc7ae7d6cab1acf69bcb87
https://git.kernel.org/stable/c/544ebb25bd58f67e821573412ab7a982b9e02211
https://git.kernel.org/stable/c/0fecd89f979a8653b9a5b0816570329b7a94a081
https://git.kernel.org/stable/c/a4bc41504690b7d7064931909874f5b98cd148b6

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.