CVE-2026-68359
hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
Not available
At a glance
- Source
- NVD
- EPSS
- EPSS 0.23 % · percentile 14 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability. Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
References
- https://git.kernel.org/stable/c/761249a3d92db83ae19670c4ecdf73c0a85bcb61
- https://git.kernel.org/stable/c/185c0880397aee9def0af5a59ea65f22f37ad658
- https://git.kernel.org/stable/c/a2a15de020597efbff84b4281dd472e5860b7e3e
- https://git.kernel.org/stable/c/205cff797a94757ec88ba299c8e2bf2e1e3f4bbf
- https://git.kernel.org/stable/c/18d7c523891004226bccdba39dd681eca22ceb8a
- https://git.kernel.org/stable/c/59d104b54b0b42e30fd2a68d24ee5c49dcc54d1e
European references
- ENISA EUVD · EUVD-2026-55460
- GCVE · GCVE-0-2026-68359
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1255 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1202 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1164 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1069 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 53e68c20aeb1e23419bed811aa3a309ceda200f9 < 761249a3d92db83ae19670c4ecdf73c0a85bcb61 ; affected 53e68c20aeb1e23419bed811aa3a309ceda200f9 < 185c0880397aee9def0af5a59ea65f22f37ad658 ; affected 53e68c20aeb1e23419bed811aa3a309ceda200f9 < a2a15de020597efbff84b4281dd472e5860b7e3e ; affected 53e68c20aeb1e23419bed811aa3a309ceda200f9 < 205cff797a94757ec88ba299c8e2bf2e1e3f4bbf ; affected 53e68c20aeb1e23419bed811aa3a309ceda200f9 < 18d7c523891004226bccdba39dd681eca22ceb8a ; affected 53e68c20aeb1e23419bed811aa3a309ceda200f9 < 59d104b54b0b42e30fd2a68d24ee5c49dcc54d1e |
| Linux · Linux | affected 5.17 ; unaffected 0 < 5.17 ; unaffected 6.1.183 ≤ 6.1.* ; unaffected 6.6.148 ≤ 6.6.* ; unaffected 6.12.101 ≤ 6.12.* ; unaffected 6.18.42 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |