CVE-2026-93189

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

A driver's probe calls hid_device_io_start() to enable input delivery,

then fails at a later initialization step and unwinds via hid_hw_stop().

The unwind frees struct hidraw via hidraw_disconnect() while in-flight

HID reports may still be running on another CPU, dereferencing the

freed object through hidraw_report_event(). syzbot reports the

resulting use-after-free for the corsair-psu HID driver.

Edward Adam Davis posted a per-driver fix for corsair-psu that adds

an explicit hid_device_io_stop() before hid_hw_stop() in the probe

error path ("hwmon: prevent packets from going to driver for probe",

2026-04-28). Auditing the tree shows 15 drivers call

hid_device_io_start(); 7 also call hid_device_io_stop() and 8 do not:

drivers calling hid_device_io_start() without a matching

hid_device_io_stop() before hid_hw_stop():

drivers/hwmon/corsair-p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References