CVE-2026-68443: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (gigabytewaterforce) Stop device IO before calling hidhwstop
Calling hidhwstop() does not stop the device IO. This results in a race condition between hidinputreport() and the point immediately following the execution of hiddeviceiostart() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.
Fix the problem by calling hiddeviceiostop() before calling hidhwstop().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the gigabyte_waterforce hwmon driver probe path, stop device IO by calling hid_device_io_stop() immediately following hid_device_io_start() and before calling hid_hw_stop(); additionally, if the probe operation fails after "io start", call hid_device_io_stop() to prevent a UAF race between hid_input_report() and the initiated stop.
Linux kernel hid-generic driver (hwmon: gigabyte_waterforce) Driver probe call order = Call hid_device_io_stop() before calling hid_hw_stop(); also stop device IO immediately following hid_device_io_start() when probe fails after "io start"
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68443?
CVE-2026-68443 has a severity rating of 43.
How do I fix CVE-2026-68443?
To fix CVE-2026-68443, ensure you update to the latest patched version of the Linux kernel.
What type of vulnerability is CVE-2026-68443?
CVE-2026-68443 is classified as a race condition vulnerability.
What systems are affected by CVE-2026-68443?
CVE-2026-68443 affects systems running the Linux kernel that utilize the gigabyte_waterforce hardware.
How does CVE-2026-68443 impact system performance?
CVE-2026-68443 can lead to potential race conditions that may cause instability and unpredictable behavior in affected devices.