CVE-2026-89623: HID: mcp2221: stop device IO before hid_hw_stop
HID: mcp2221: stop device IO before hidhwstop
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.109 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Compensating control
In the Linux kernel HID mcp2221 driver, guard the call to hid_device_io_stop() with io_started in mcp2221_hid_unregister(), so device I/O is stopped before hid_hw_stop() without warning when io_started is already cleared during normal removal.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel MCP2221 HID driver are exposed during MCP2221 device probe failure or device removal, when incoming HID reports can race with hardware teardown.
What conditions are required for the race to occur?
Device I/O must still be active while the driver's cleanup path tears down HID hardware. Incoming HID reports can then access resources after they have been freed.
How does the fix mitigate the issue?
The fix stops device I/O at the start of the MCP2221 cleanup callback before calling hid_hw_stop(). It only calls hid_device_io_stop() when io_started is set, preserving probe-failure cleanup while avoiding warnings during normal removal.