UBUNTU-CVE-2026-97968: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Create debugfs entries after hwmon registration ccpdebugfsinit() registers debugfs files whose private data is the devm allocated ccp. It runs before hwmondeviceregisterwithinfo(), so when that registration fails, ccpprobe() returns with the files still in place. The HID core then frees ccp, and ccpremove() is not called for a failed probe, so nothing removes them later either. Reading one of the files dereferences the freed pointer. Create the debugfs entries only after the hwmon device has been registered, so no failing path can leave them behind. The two version queries stay where they are. They send USB commands without holding ccp->mutex, which is only safe as long as nothing else can call sendusbcmd(); once the hwmon device is registered its callbacks can do so concurrently. Only the debugfs creation moves, and it is told which queries succeeded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Move ccp_debugfs_init() until after the hwmon device has been registered, and pass it only the queries that succeeded; keep the two version queries before hwmon registration.
Linux kernel hwmon corsair-cpro driver debugfs entry creation order = after hwmon_device_register_with_info() succeeds
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using an affected Ubuntu kernel package and the Corsair Commander Pro hwmon driver are exposed when a device probe reaches the driver's failure path after debugfs files have been created. The listed packages include linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
What must happen for the use-after-free condition to occur?
The Corsair Commander Pro driver registration must fail after it has created its debugfs files. The failed probe frees the driver's private data while leaving those files present; reading one of the leftover files then dereferences the freed pointer.
How can an administrator tell whether a system may already be affected?
Look for debugfs files created by the corsair-cpro driver that remain present after a failed device probe. The issue is specifically triggered by reading such stale files after the driver's private data has been freed.