CVE-2026-89623: HID: mcp2221: stop device IO before hid_hw_stop
Published Sep 11, 2026
·Updated
HID: mcp2221: stop device IO before hidhwstop
Affected Software
1 affected component
Linux kernel mcp2221 HID driver
Event History
Sep 11, 2026
CVE Published
via MITRE·07:45 PM
Data Sourced
via MITRE·07:45 PM
Description
Data Sourced
via NVD·08:19 PM
Description
Sep 13, 2026
Data Sourced
via Microsoft·08:06 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which systems are exposed to this issue?
Systems using the Linux kernel MCP2221 HID driver are exposed during MCP2221 device probe failure or device removal, when incoming HID reports can race with hardware teardown.
2
What conditions are required for the race to occur?
Device I/O must still be active while the driver's cleanup path tears down HID hardware. Incoming HID reports can then access resources after they have been freed.
3
How does the fix mitigate the issue?
The fix stops device I/O at the start of the MCP2221 cleanup callback before calling hid_hw_stop(). It only calls hid_device_io_stop() when io_started is set, preserving probe-failure cleanup while avoiding warnings during normal removal.