CVE-2026-68361: hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
hwmon: (corsair-psu) Stop device IO before calling hidhwstop
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Configuration
Ensure that when corsairpsu_probe() fails after IO has been started, hid_device_io_stop() is called before hid_hw_stop(), to clear the io_started flag while holding driver_input_lock and prevent the hid_input_report vs. disconnect UAF race.
Linux kernel HID core (drivers/hid/hid-core.c) Stop device IO before calling hid_hw_stop() = Apply code change: call hid_device_io_stop() before hid_hw_stop() when probe fails
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-68361?
CVE-2026-68361 has a risk level of 40.
What does CVE-2026-68361 affect?
CVE-2026-68361 affects the Linux kernel, specifically the hwmon component related to corsair-psu.
What type of vulnerabilities are associated with CVE-2026-68361?
CVE-2026-68361 is associated with Use After Free and Race Condition vulnerabilities.
How can I mitigate CVE-2026-68361?
Mitigation for CVE-2026-68361 involves updating the Linux kernel to the patched version.
What is the main issue described in CVE-2026-68361?
CVE-2026-68361 describes a race condition in the hid_hw_stop function that fails to stop device IO.