UBUNTU-CVE-2026-97967: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Remove debugfs entries when probe fails ccpdebugfsinit() registers debugfs files whose private data is the devm allocated ccp. If hwmondeviceregisterwithinfo() fails right after it, ccpprobe() returns without removing them: the HID core then frees ccp, and ccpremove() is not called for a failed probe, so the files stay behind. Reading one of them dereferences the freed pointer. Remove the debugfs entries on that error path. debugfsremoverecursive() waits for readers already inside the show callbacks, so ccp is no longer reachable through debugfs by the time probe returns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
On the ccp_probe() error path after hwmon_device_register_with_info() fails, remove the debugfs entries with debugfs_remove_recursive() before returning, so ccp is no longer reachable through debugfs.
Event History
Frequently Asked Questions
What conditions are required for the use-after-free to be reachable?
The Corsair CPRO driver must create its debugfs entries, then fail when registering its hwmon device. After that failed probe, reading one of the leftover debugfs files dereferences the freed driver data.
Is normal device removal sufficient to trigger the issue?
No. The described condition occurs on a failed probe path, where the driver's normal remove callback is not invoked; this leaves debugfs entries behind after HID frees the driver data.
Which Ubuntu kernel package variants are listed for this issue?
The listed variants are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.