CVE-2026-68358

Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.

Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68358.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

f3b4b146eb107bda47ee4a8b0927699f962e8a2f

Fixed

8cb282c34d582afcca7b1bae7c7bcd5204fd03d6

Fixed

305c23993e43db9a3681978691b1f9f2a1b26299

Fixed

dc73b0dfeab8dc0fe73e29c4401d032279e23efd

Fixed

f151d0143ac4e086f92f52328ebdbdc50933d8ef

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68358.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.9.0

Fixed

6.12.101

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.42

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.1.6

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68358.json"