CVE-2026-68359: hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
hwmon: (nzxt-smart2) Stop device IO before calling hidhwstop
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Configuration
In the driver probe function for hwmon: (nzxt-smart2), stop device IO by calling hid_device_io_stop() before calling hid_hw_stop(). Specifically, immediately following execution of hid_device_io_start(), if the probe operation fails after "io start", call hid_device_io_stop() before calling hid_hw_stop() to avoid the UAF race between hid_input_report() and the initiated point.
Linux kernel hid hwmon driver (nzxt-smart2) probe cleanup order: call hid_device_io_stop() before hid_hw_stop() = call hid_device_io_stop() immediately following hid_device_io_start() failure and before hid_hw_stop()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68359?
The severity of CVE-2026-68359 is rated at risk level 46.
How do I fix CVE-2026-68359?
To fix CVE-2026-68359, ensure that the Linux kernel is updated to the patched version that addresses this race condition.
What causes the vulnerability CVE-2026-68359?
CVE-2026-68359 is caused by a race condition that occurs when calling hid_hw_stop without properly stopping the device IO first.
Which software is affected by CVE-2026-68359?
CVE-2026-68359 affects the Linux Kernel, particularly the hwmon module for nzxt-smart2.
What are the implications of CVE-2026-68359?
The implications of CVE-2026-68359 include potential unexpected behavior in device IO operations due to the race condition.