CVE-2026-97967: hwmon: (corsair-cpro) Remove debugfs entries when probe fails
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (corsair-cpro) Remove debugfs entries when probe fails
ccpdebugfsinit() registers debugfs files whose private data is the devm allocated ccp. If hwmondeviceregisterwithinfo() fails right after it, ccpprobe() returns without removing them: the HID core then frees ccp, and ccpremove() is not called for a failed probe, so the files stay behind. Reading one of them dereferences the freed pointer.
Remove the debugfs entries on that error path. debugfsremoverecursive() waits for readers already inside the show callbacks, so ccp is no longer reachable through debugfs by the time probe returns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ccp_probe()'s hwmon_device_register_with_info() failure path, remove the debugfs entries with debugfs_remove_recursive() before returning, so the devm-allocated ccp cannot remain reachable through debugfs after it is freed.
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
The Corsair CPRO driver's probe must create its debugfs entries and then fail when registering the hwmon device. A local user or process that can read the leftover debugfs files can then trigger dereferencing of the freed driver data.
Are systems affected during normal successful device initialization?
The described stale debugfs entries occur only on the probe error path after debugfs initialization and before successful hwmon device registration. A successful probe does not follow that failed-probe path.
What can be done if the fix cannot be deployed immediately?
Avoid reading the Corsair CPRO debugfs files on systems where device probing has failed. Removing or disabling access to the relevant debugfs interface prevents readers from reaching the stale files, although the provided data does not specify a particular mount path or configuration change.
How can administrators identify an affected state?
An affected state requires a failed Corsair CPRO probe that left its debugfs files registered. The provided information does not specify file names, log messages, or another definitive detection method.