CVE-2026-68358 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.
Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the Linux kernel's hardware monitoring subsystem, specifically affecting the nzxt-kraken3 driver which manages cooling devices. The issue stems from improper handling of device input/output operations during driver initialization and cleanup processes. When the hardware monitoring driver attempts to initialize a device, it calls hid_device_io_start() to begin device I/O operations, but fails to properly terminate these operations before invoking hid_hw_stop(). This fundamental flaw creates a race condition that can lead to critical memory safety issues.
The technical flaw manifests as a potential use-after-free vulnerability occurring when the driver probe function encounters failure after initiating I/O operations. The race condition specifically occurs between hid_input_report() which processes input reports from the device and the point immediately following hid_device_io_start() execution within the driver's probe routine. When the probe fails during this window, previously allocated memory structures may be freed while still being referenced by the input report processing thread, creating a dangerous state where memory corruption can occur.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially allow privilege escalation and system instability. Attackers could exploit this race condition to manipulate kernel memory structures, potentially leading to arbitrary code execution with kernel privileges. The vulnerability affects systems running Linux kernels that include the affected hardware monitoring driver, particularly those using NZXT Kraken cooling devices that rely on the specific driver implementation. This represents a significant security risk in environments where unprivileged users might have access to system resources or when the device is connected during system operation.
The fix implemented addresses this issue by modifying the driver's cleanup sequence to properly stop device I/O operations before calling hid_hw_stop(). This ensures that all pending input operations are completed or terminated before the device interface is fully shut down, eliminating the race condition window. The solution follows established kernel development practices for managing hardware device lifecycle operations and aligns with common security principles for preventing use-after-free vulnerabilities in kernel space code. This remediation directly addresses the root cause by ensuring proper ordering of I/O operation termination relative to device shutdown procedures, thereby preventing the conditions that enable the race condition and subsequent memory safety violations.
This vulnerability classification aligns with CWE-416 Use After Free and CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization. The fix demonstrates proper adherence to kernel driver development standards and follows ATT&CK technique T1068 for privilege escalation through kernel vulnerabilities. The solution represents a targeted patch that addresses the specific race condition without disrupting normal device functionality, maintaining system stability while eliminating the security risk.