CVE-2026-68361: hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (corsair-psu) Stop device IO before calling hidhwstop
hidhwstop() does not stop the device IO.
This results in a race condition between hidinputreport() and the point immediately following the execution of hiddeviceiostart() within corsairpsuprobe(). If the probe operation fails after "io start" has been initiated, this race condition will result in a uaf vulnerability [1].
CPU0 CPU1 ==== ==== corsairpsuprobe() hiddeviceiostart() ... unlock driverinputlock hidhwstop() kfree(hidraw) hidinputreport() ... acquire driverinputlock hidreportrawevent() hidrawreportevent() ... access hidraw's listlock // trigger uaf
Consequently, when corsairpsuprobe() fails and hidhwstop() needs to be executed, the iostarted flag is first cleared while holding the driverinputlock to prevent potential race conditions involving input reports.
[1] BUG: KASAN: slab-use-after-free in rtspinlock+0x83/0x400 kernel/locking/spinlockrt.c:56 Call Trace: hidrawreportevent+0x5d/0x3a0 drivers/hid/hidraw.c:577 hidreportrawevent+0x311/0x1730 drivers/hid/hid-core.c:2076 hidinputreport drivers/hid/hid-core.c:2152 [inline] hidinputreport+0x44e/0x580 drivers/hid/hid-core.c:2174 hidirqin+0x47e/0x6d0 drivers/hid/usbhid/hid-core.c:286 usbhcdgivebackurb+0x3b3/0x5e0 drivers/usb/core/hcd.c:1657 dummytimer+0x8a9/0x47d0 drivers/usb/gadget/udc/dummyhcd.c:2005
Allocated by task 10: hidrawconnect+0x57/0x430 drivers/hid/hidraw.c:606 hidconnect+0x5bf/0x19d0 drivers/hid/hid-core.c:2277 hidhwstart+0xa8/0x120 drivers/hid/hid-core.c:2387 corsairpsuprobe+0xd9/0x3c0 drivers/hwmon/corsair-psu.c:782
Freed by task 10: hidrawdisconnect+0x4f/0x60 drivers/hid/hidraw.c:662 hiddisconnect drivers/hid/hid-core.c:2362 [inline] hidhwstop+0x101/0x1e0 drivers/hid/hid-core.c:2407 corsairpsuprobe+0x327/0x3c0 drivers/hwmon/corsair-psu.c:826
Fix the problem by calling hiddeviceiostop() before calling hidhwstop().
[groeck: Updated subject and description; call hiddeviceiostop() only if IO has been started]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure that when corsairpsu_probe() fails after IO has been started, hid_device_io_stop() is called before hid_hw_stop(), to clear the io_started flag while holding driver_input_lock and prevent the hid_input_report vs. disconnect UAF race.
Linux kernel HID core (drivers/hid/hid-core.c) Stop device IO before calling hid_hw_stop() = Apply code change: call hid_device_io_stop() before hid_hw_stop() when probe fails
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-68361?
CVE-2026-68361 has a risk level of 40.
What does CVE-2026-68361 affect?
CVE-2026-68361 affects the Linux kernel, specifically the hwmon component related to corsair-psu.
What type of vulnerabilities are associated with CVE-2026-68361?
CVE-2026-68361 is associated with Use After Free and Race Condition vulnerabilities.
How can I mitigate CVE-2026-68361?
Mitigation for CVE-2026-68361 involves updating the Linux kernel to the patched version.
What is the main issue described in CVE-2026-68361?
CVE-2026-68361 describes a race condition in the hid_hw_stop function that fails to stop device IO.