CVE-2026-68360 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.
Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the Linux kernel's hardware monitoring subsystem specifically affecting the corsair-cpro driver implementation. The flaw stems from improper device I/O management during the driver probe sequence where the hid_hw_stop() function is invoked without first ensuring that device I/O operations are properly terminated. This oversight creates a critical race condition scenario that can lead to use-after-free vulnerabilities within the kernel's hardware monitoring framework.
The technical root cause lies in the sequence of operations during driver initialization where hid_device_io_start() is called to initiate device I/O, but when probe failures occur afterward, hid_hw_stop() alone fails to halt ongoing I/O operations. This creates a window where hid_input_report() can still process incoming data while the driver is transitioning through its cleanup phase. The race condition manifests when the kernel attempts to free memory resources associated with the device structure while I/O processing threads might still be accessing those same memory regions, leading to unpredictable behavior and potential privilege escalation opportunities.
From a cybersecurity perspective, this vulnerability aligns with CWE-416 which describes use-after-free conditions, and represents a significant operational risk within kernel space environments. The flaw can be exploited by malicious actors to gain elevated privileges or cause system instability through carefully crafted device interactions that trigger the race condition during driver probe failure scenarios. The attack surface is particularly concerning as it affects the core hardware monitoring infrastructure that many systems rely upon for thermal management and power consumption monitoring.
The fix implemented addresses this by introducing proper I/O termination sequence before calling hid_hw_stop(), specifically requiring hid_device_io_stop() to be invoked prior to the stop operation. This ensures that all active I/O operations are properly halted before attempting to clean up device resources, eliminating the race condition window that previously enabled the use-after-free scenario. The solution follows established kernel development practices for managing hardware device lifecycle operations and aligns with ATT&CK technique T1068 which covers privilege escalation through kernel vulnerabilities.
The remediation approach ensures proper resource management throughout the driver initialization process by maintaining strict ordering of I/O operations. This prevents scenarios where device resources might be freed while active processing threads continue to reference them, thereby protecting against both local privilege escalation and potential denial-of-service conditions that could arise from memory corruption during device probe failures. The change represents a defensive programming approach that enforces proper state transitions in kernel hardware drivers and demonstrates adherence to secure coding practices for embedded system development.
This vulnerability highlights the importance of careful resource management in kernel space where improper sequence of operations can create exploitable race conditions. The fix reinforces proper driver lifecycle management by ensuring I/O operations are terminated before cleanup phases begin, preventing memory corruption scenarios that could be leveraged by attackers to compromise system integrity and confidentiality. The resolution maintains backward compatibility while strengthening the overall security posture of Linux systems relying on hardware monitoring capabilities.