{"id":26046,"date":"2026-09-18T04:32:16","date_gmt":"2026-09-17T20:32:16","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93189"},"modified":"2026-09-18T04:32:16","modified_gmt":"2026-09-17T20:32:16","slug":"cve-2026-93189","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93189","title":{"rendered":"CVE-2026-93189 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: quiesce in"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>HID: core: quiesce input in hid_hw_stop() to prevent use-after-free<\/p>\n<p>A driver&#8217;s probe calls hid_device_io_start() to enable input delivery,<br \/>\nthen fails at a later initialization step and unwinds via hid_hw_stop().<br \/>\nThe unwind frees struct hidraw via hidraw_disconnect() while in-flight<br \/>\nHID reports may still be running on another CPU, dereferencing the<br \/>\nfreed object through hidraw_report_event(). syzbot reports the<br \/>\nresulting use-after-free for the corsair-psu HID driver.<\/p>\n<p>Edward Adam Davis posted a per-driver fix for corsair-psu that adds<br \/>\nan explicit hid_device_io_stop() before hid_hw_stop() in the probe<br \/>\nerror path (&#8220;hwmon: prevent packets from going to driver for probe&#8221;,<br \/>\n2026-04-28). Auditing the tree shows 15 drivers call<br \/>\nhid_device_io_start(); 7 also call hid_device_io_stop() and 8 do not:<\/p>\n<p>  drivers calling hid_device_io_start() without a matching<br \/>\n  hid_device_io_stop() before hid_hw_stop():<br \/>\n    drivers\/hwmon\/corsair-psu.c       (fix posted by Edward)<br \/>\n    drivers\/hwmon\/corsair-cpro.c<br \/>\n    drivers\/hwmon\/nzxt-kraken3.c<br \/>\n    drivers\/hwmon\/nzxt-smart2.c<br \/>\n    drivers\/hwmon\/gigabyte_waterforce.c<br \/>\n    drivers\/hid\/hid-logitech-dj.c<br \/>\n    drivers\/hid\/hid-nintendo.c<br \/>\n    drivers\/hid\/hid-mcp2221.c<\/p>\n<p>Roughly half of all callers of the API are exposed. Centralize the<br \/>\nquiesce in hid_hw_stop() so callers do not have to remember the<br \/>\nmatching stop: if a driver has left hdev-&gt;io_started true on entry,<br \/>\ncall hid_device_io_stop() before hid_disconnect().<\/p>\n<p>For the 7 drivers that already call hid_device_io_stop() correctly,<br \/>\nhdev-&gt;io_started is false on entry, the guard short-circuits, and<br \/>\nbehavior is unchanged.<\/p>\n<p>No Fixes: tag because the affected drivers gained their<br \/>\nhid_device_io_start() calls independently over years; the bug is a<br \/>\nclass-wide API misuse rather than a regression from one commit.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>HID: core: quiesce input in hid_hw_stop() to prevent use-after-free<\/p>\n<p>A driver&#8217;s probe calls hid_device_io_start() to enable input d<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26046","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}