CVE-2026-68359: hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (nzxt-smart2) Stop device IO before calling hidhwstop
Calling hidhwstop() does not stop the device IO. This results in a race condition between hidinputreport() and the point immediately following the execution of hiddeviceiostart() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.
Fix the problem by calling hiddeviceiostop() before calling hidhwstop().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the driver probe function for hwmon: (nzxt-smart2), stop device IO by calling hid_device_io_stop() before calling hid_hw_stop(). Specifically, immediately following execution of hid_device_io_start(), if the probe operation fails after "io start", call hid_device_io_stop() before calling hid_hw_stop() to avoid the UAF race between hid_input_report() and the initiated point.
Linux kernel hid hwmon driver (nzxt-smart2) probe cleanup order: call hid_device_io_stop() before hid_hw_stop() = call hid_device_io_stop() immediately following hid_device_io_start() failure and before hid_hw_stop()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68359?
The severity of CVE-2026-68359 is rated at risk level 46.
How do I fix CVE-2026-68359?
To fix CVE-2026-68359, ensure that the Linux kernel is updated to the patched version that addresses this race condition.
What causes the vulnerability CVE-2026-68359?
CVE-2026-68359 is caused by a race condition that occurs when calling hid_hw_stop without properly stopping the device IO first.
Which software is affected by CVE-2026-68359?
CVE-2026-68359 affects the Linux Kernel, particularly the hwmon module for nzxt-smart2.
What are the implications of CVE-2026-68359?
The implications of CVE-2026-68359 include potential unexpected behavior in device IO operations due to the race condition.