UBUNTU-CVE-2026-89623: Use After Free

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister() so that incoming HID reports cannot race with hardware teardown during probe failure or device removal, addressing a potential use-after-free. Guard the call to hiddeviceiostop() with iostarted. On normal removal hiddeviceremove() has already cleared iostarted before the devres group is released, so an unconditional call would otherwise hit the !iostarted path and emit a spurious "io already stopped" warning on every removal. The guard preserves the probe-failure balancing, where iostarted is still set after hiddeviceiostart(), while staying silent on the normal removal path.