CVE-2026-93189: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-93189 is a use-after-free vulnerability in the Linux kernel's HID (Human Interface Device) subsystem, specifically in the hid_hw_stop() function. It arises when a driver's probe calls hid_device_io_start() to enable input delivery, then fails during a later initialization step and unwinds via hid_hw_stop(), which frees struct hidraw while in-flight HID reports on another CPU may still dereference the freed memory. Eight HID drivers are affected, including those for Corsair, NZXT, Gigabyte, Logitech, Nintendo, and MCP2221 peripherals. The vulnerability was disclosed on September 17, 2026, and is estimated HIGH severity by Feedly; an official CVSS score has not yet been published (GitHub Advisory, Feedly).

The root cause is a class-wide API misuse (CWE not formally assigned) where HID drivers call hid_device_io_start() without a matching hid_device_io_stop() before invoking hid_hw_stop() in probe error paths. This creates a race condition: hidraw_disconnect() frees the struct hidraw object while another CPU thread may still be executing hidraw_report_event() on the same object, resulting in a use-after-free. The fix centralizes the quiesce logic inside hid_hw_stop() itself — if hdev->io_started is true on entry, hid_device_io_stop() is called before hid_disconnect(), eliminating the need for each driver to handle this individually. The bug was originally reported by syzbot for the corsair-psu driver, and auditing revealed 8 of 15 drivers using hid_device_io_start() were exposed (GitHub Advisory, Kernel Announce).

Successful exploitation can cause a kernel use-after-free condition, potentially resulting in a kernel crash (denial of service) or, in more severe scenarios, local privilege escalation or arbitrary code execution in kernel context. The vulnerability is locally scoped, requiring either physical access to attach an affected HID device or the ability to trigger driver probe and removal sequences. Affected drivers span popular peripheral categories including Corsair PSUs and coolers, NZXT liquid coolers and fan controllers, Gigabyte water cooling, Logitech DJ receivers, Nintendo controllers, and MCP2221 USB bridges (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability requires local access — either physical attachment of an affected HID device or the ability to trigger driver probe/removal — limiting its remote exploitability. No threat actor attribution has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. An EPSS score has not yet been published for this CVE.

The Linux kernel has been patched across multiple stable branches; fixed versions include 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1 (GitHub Advisory). The fix centralizes hid_device_io_stop() within hid_hw_stop() so individual drivers no longer need to call it explicitly in error paths. As a short-term workaround for drivers not yet patched, administrators can ensure hid_device_io_stop() is explicitly called before hid_hw_stop() in probe error paths, as demonstrated by Edward Adam Davis's per-driver fix for corsair-psu. Users should update to a patched kernel version as the primary remediation.