CVE-2026-93189

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the HID core. When a driver's probe process calls hid device io start() to enable input delivery but subsequently fails during initialization, it unwinds via hid hw stop(). This process frees the struct hidraw through hidraw disconnect(). However, if HID reports are still being processed on another CPU, they may attempt to dereference the freed object via the hidraw report event() function. This API misuse affects several drivers, including corsair-psu, corsair-cpro, nzxt-kraken3, nzxt-smart2, gigabyte waterforce, hid-logitech-dj, hid-nintendo, and hid-mcp2221.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.