CVE-2026-89623: HID: mcp2221: stop device IO before hid_hw_stop
In the Linux kernel, the following vulnerability has been resolved:
HID: mcp2221: stop device IO before hidhwstop
Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister() so that incoming HID reports cannot race with hardware teardown during probe failure or device removal, addressing a potential use-after-free.
Guard the call to hiddeviceiostop() with iostarted. On normal removal hiddeviceremove() has already cleared iostarted before the devres group is released, so an unconditional call would otherwise hit the !iostarted path and emit a spurious "io already stopped" warning on every removal. The guard preserves the probe-failure balancing, where iostarted is still set after hiddeviceiostart(), while staying silent on the normal removal path.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel MCP2221 HID driver are exposed during MCP2221 device probe failure or device removal, when incoming HID reports can race with hardware teardown.
What conditions are required for the race to occur?
Device I/O must still be active while the driver's cleanup path tears down HID hardware. Incoming HID reports can then access resources after they have been freed.
How does the fix mitigate the issue?
The fix stops device I/O at the start of the MCP2221 cleanup callback before calling hid_hw_stop(). It only calls hid_device_io_stop() when io_started is set, preserving probe-failure cleanup while avoiding warnings during normal removal.