CVE-2026-93189 Linux CVE debrief

Who should care

Roles: Linux kernel maintainers, Linux distribution maintainers, system administrators. Deployment contexts: Linux-based systems with HID drivers. The vulnerability requires verification of affected versions and exposure.

Why it matters

A use-after-free vulnerability in the Linux kernel's HID core requires verification of affected versions and exposure. Linux kernel maintainers, Linux distribution maintainers, and system administrators should assess exposure and verify if Linux kernel versions in use have the centralized quiesce fix applied.

• Verify if Linux kernel versions in use have the centralized quiesce fix applied to prevent use-after-free conditions.
• Assess exposure for systems using HID drivers that call hid_device_io_start() without a matching hid_device_io_stop() before hid_hw_stop().
• Inventory Linux kernel versions and HID driver usage to identify potentially affected systems.
• Monitor for updates from Linux kernel maintainers regarding this vulnerability.

Technical summary

The Linux kernel's HID core has a use-after-free vulnerability. When a driver's probe fails after enabling input delivery, the unwind process frees the struct hidraw object while in-flight HID reports may still be running on another CPU, leading to a use-after-free condition through hidraw_report_event(). A fix has been applied to centralize quiescing input in hid_hw_stop() to prevent the use-after-free condition. This issue affects roughly half of the callers of the hid_device_io_start() API, including drivers/hwmon/corsair-psu.c, drivers/hwmon/corsair-cpro.c, drivers/hwmon/nzxt-kraken3.c, drivers/hwmon/nzxt-smart2.c, drivers/hwmon/gigabyte_waterforce.c, drivers/hid/hid-logitech-dj.c, drivers/hid/hid-nintendo.

Defensive priority

High

Recommended defensive actions

• Assess exposure for systems using the Linux kernel with HID drivers that call hid_device_io_start() without a matching hid_device_io_stop() before hid_hw_stop().
• Verify if the Linux kernel version in use has the centralized quiesce fix applied.
• Inventory Linux kernel versions and HID driver usage to identify potentially affected systems.
• Monitor for updates from Linux kernel maintainers regarding this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The Linux kernel's HID core has a use-after-free vulnerability. A fix has been applied to centralize quiescing input in hid_hw_stop() to prevent the use-after-free condition. The affected drivers gained their hid_device_io_start() calls independently over the years.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.