CVE-2026-53037: HID: usbhid: fix deadlock in hid_post_reset()
HID: usbhid: fix deadlock in hidpostreset()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Ensure that all memory allocations performed inside hid_pre_reset() and hid_post_reset() use GFP_NOIO to prevent deadlock caused by block IO while the device reset mutex is held.
Linux kernel usbhid (hid_pre_reset() / hid_post_reset()) Use GFP_NOIO for all allocations = GFP_NOIO
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53037?
CVE-2026-53037 has a risk score of 27.
How do I fix CVE-2026-53037?
To resolve CVE-2026-53037, ensure that your Linux kernel is updated to the latest version where this vulnerability has been patched.
What type of vulnerability is CVE-2026-53037?
CVE-2026-53037 is a deadlock vulnerability within the HID subsystem of the Linux kernel.
What components are affected by CVE-2026-53037?
CVE-2026-53037 affects USB devices that incorporate HID and storage or UAS components that need to be reset together.
How does CVE-2026-53037 impact system performance?
CVE-2026-53037 can lead to a deadlock scenario when attempting to reset certain USB devices, potentially causing the system to become unresponsive.