CVE-2026-93826HID: hidpp: fix potential UAF in hidpp_connect_event()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidpp_connect_event() If input_register_device() fails, we call input_free_device(), but keep stale pointer to the old device in hidpp->input, which could potentially lead to UAF. Fix that by resetting it to NULL before returning from hidpp_connect_event().
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from c39e3d5fc9dd3e16c6f59dd94d827540040de66d before e03fd646adad7f97fa4429ec5f38cee9bde5276e; from c39e3d5fc9dd3e16c6f59dd94d827540040de66d before 5d7637f4d050d105177217e64b869f56f9825060; from c39e3d5fc9dd3e16c6f59dd94d827540040de66d before 3b8b2e58b078cd30e121401535541bb8a6d57133; from c39e3d5fc9dd3e16c6f59dd94d827540040de66d before 3303398cc2aa255ba251650a30024e11d48ea6c3; from c39e3d5fc9dd3e16c6f59dd94d827540040de66d before 6df6b1f2c49678211f65647c300bc51dda02893b | CNA record |
References
- https://git.kernel.org/stable/c/e03fd646adad7f97fa4429ec5f38cee9bde5276e
- https://git.kernel.org/stable/c/5d7637f4d050d105177217e64b869f56f9825060
- https://git.kernel.org/stable/c/3b8b2e58b078cd30e121401535541bb8a6d57133
- https://git.kernel.org/stable/c/3303398cc2aa255ba251650a30024e11d48ea6c3
- https://git.kernel.org/stable/c/6df6b1f2c49678211f65647c300bc51dda02893b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.