CVE-2026-90329 (GCVE-0-2026-90329)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54
VLAI
Title
HID: synchronize input before cleaning up a failed probe
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: synchronize input before cleaning up a failed probe hid_device_io_start() allows reports to run concurrently with probe. If the probe subsequently fails, __hid_device_probe() releases driver resources and clears hdev->driver without first excluding those report callbacks. For example, a report may enter hidraw_report_event() while the failure path frees the associated hidraw object, leading to a use-after-free when the report takes the object's list lock. Stop input before performing failed-probe cleanup. This reacquires driver_input_lock and waits for any report callback already in progress.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c849a6143bec520aff2a6646518b0d041402428b , < 3ffb088a2ed34ca982cfc2c81d107ce370aa45f1 (git)
Affected: c849a6143bec520aff2a6646518b0d041402428b , < 2c35cdeb13a0c52429501e66f368fa59cad235f6 (git)
Affected: c849a6143bec520aff2a6646518b0d041402428b , < 98201b46f7e33fe11af6f024fecb40fb56634225 (git)
Affected: c849a6143bec520aff2a6646518b0d041402428b , < 9a3da56aae28e1ad3a3e591f72a537742053ecd2 (git)
Affected: c849a6143bec520aff2a6646518b0d041402428b , < edd490b8ad85c052eaf10dcc9f390ea54f1e1b39 (git)
Affected: c849a6143bec520aff2a6646518b0d041402428b , < 01eeb601a1626e683fb7b77c63f442b06fb87093 (git)
Affected: c849a6143bec520aff2a6646518b0d041402428b , < b85d1000eb8842768970f2fd0a8fd362472d02d5 (git)
Affected: c849a6143bec520aff2a6646518b0d041402428b , < 207853d46f7ef2e28042344a1468da8754c3ddbf (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ffb088a2ed34ca982cfc2c81d107ce370aa45f1",
              "status": "affected",
              "version": "c849a6143bec520aff2a6646518b0d041402428b",
              "versionType": "git"
            },
            {
              "lessThan": "2c35cdeb13a0c52429501e66f368fa59cad235f6",
              "status": "affected",
              "version": "c849a6143bec520aff2a6646518b0d041402428b",
              "versionType": "git"
            },
            {
              "lessThan": "98201b46f7e33fe11af6f024fecb40fb56634225",
              "status": "affected",
              "version": "c849a6143bec520aff2a6646518b0d041402428b",
              "versionType": "git"
            },
            {
              "lessThan": "9a3da56aae28e1ad3a3e591f72a537742053ecd2",
              "status": "affected",
              "version": "c849a6143bec520aff2a6646518b0d041402428b",
              "versionType": "git"
            },
            {
              "lessThan": "edd490b8ad85c052eaf10dcc9f390ea54f1e1b39",
              "status": "affected",
              "version": "c849a6143bec520aff2a6646518b0d041402428b",
              "versionType": "git"
            },
            {
              "lessThan": "01eeb601a1626e683fb7b77c63f442b06fb87093",
              "status": "affected",
              "version": "c849a6143bec520aff2a6646518b0d041402428b",
              "versionType": "git"
            },
            {
              "lessThan": "b85d1000eb8842768970f2fd0a8fd362472d02d5",
              "status": "affected",
              "version": "c849a6143bec520aff2a6646518b0d041402428b",
              "versionType": "git"
            },
            {
              "lessThan": "207853d46f7ef2e28042344a1468da8754c3ddbf",
              "status": "affected",
              "version": "c849a6143bec520aff2a6646518b0d041402428b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: synchronize input before cleaning up a failed probe\n\nhid_device_io_start() allows reports to run concurrently with probe. If\nthe probe subsequently fails, __hid_device_probe() releases driver\nresources and clears hdev-\u003edriver without first excluding those report\ncallbacks.\n\nFor example, a report may enter hidraw_report_event() while the failure\npath frees the associated hidraw object, leading to a use-after-free when\nthe report takes the object\u0027s list lock.\n\nStop input before performing failed-probe cleanup. This reacquires\ndriver_input_lock and waits for any report callback already in progress."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - HID input reports that race __hid_device_probe() cleanup after hid_device_io_start() arrive from an adjacent Bluetooth HID peer via hidp_recv_intr_frame() \u2192 hidp_process_report() \u2192 hid_input_report(). nintendo_hid_probe() for HID_BLUETOOTH_DEVICE Joy-Con/Pro calls hid_hw_start(HID_CONNECT_HIDRAW) then hid_device_io_start() before joycon_init() can fail.\nAC:L - The attacker device both fails probe after hid_device_io_start() (nintendo joycon_init(), or mcp2221 mcp_set_i2c_speed() returning error with io still started) and sends interrupt reports so hidraw_report_event() runs on another CPU while hid_close_report()/hidraw_disconnect() free the object; both sides of the race are attacker-driven.\nPR:N - hid_device_probe() matches and probes the HID device with no host uid, capability, or user-namespace check. A Bluetooth HID peer needs no Linux account; CAP_NET_ADMIN is only required for bluetoothd HIDPCONNADD, not for the peripheral to deliver hidp interrupt frames.\nUI:N - hidp_session_dev_work() calls hid_add_device(), which runs hid_device_probe() automatically once the HIDP session exists; after hid_device_io_start(), interrupt reports are processed with no victim open, mount, or other action (pairing is an attacker prerequisite, not exploit-time UI).\nS:U - The use-after-free is of host-kernel hidraw and hid_report objects inside HID core cleanup; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - hid_report_raw_event() can enter hidraw_report_event() and take hidraw-\u003elist_lock on an object already freed by hidraw_disconnect()/hid_close_report() in the failed-probe path, a use-after-free that can be reused for an arbitrary kernel read.\nI:H - The same freed hidraw/hid_report object is written (list_lock, kmemdup into list buffers) and can be sprayed, yielding an arbitrary write or control-flow hijack primitive from the in-flight report callback.\nA:H - hidraw_report_event() taking the freed hidraw-\u003elist_lock, or hid_get_report() walking reports already freed by hid_close_report(), oopses or panics the kernel even when the UAF is not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:40.648Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ffb088a2ed34ca982cfc2c81d107ce370aa45f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c35cdeb13a0c52429501e66f368fa59cad235f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/98201b46f7e33fe11af6f024fecb40fb56634225"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a3da56aae28e1ad3a3e591f72a537742053ecd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/edd490b8ad85c052eaf10dcc9f390ea54f1e1b39"
        },
        {
          "url": "https://git.kernel.org/stable/c/01eeb601a1626e683fb7b77c63f442b06fb87093"
        },
        {
          "url": "https://git.kernel.org/stable/c/b85d1000eb8842768970f2fd0a8fd362472d02d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/207853d46f7ef2e28042344a1468da8754c3ddbf"
        }
      ],
      "title": "HID: synchronize input before cleaning up a failed probe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90329",
    "datePublished": "2026-09-17T16:08:43.304Z",
    "dateReserved": "2026-09-11T19:38:34.803Z",
    "dateUpdated": "2026-09-18T17:54:40.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90329",
      "date": "2026-09-25",
      "epss": "0.004",
      "percentile": "0.31572"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:30:52.000Z",
      "cve": "CVE-2026-90329",
      "id": "msrc_CVE-2026-90329",
      "initial_release_date": "2026-09-19T01:11:20.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "HID: synchronize input before cleaning up a failed probe",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90329.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/hid-core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3ffb088a2ed34ca982cfc2c81d107ce370aa45f1",
                    "status": "affected",
                    "version": "c849a6143bec520aff2a6646518b0d041402428b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2c35cdeb13a0c52429501e66f368fa59cad235f6",
                    "status": "affected",
                    "version": "c849a6143bec520aff2a6646518b0d041402428b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "98201b46f7e33fe11af6f024fecb40fb56634225",
                    "status": "affected",
                    "version": "c849a6143bec520aff2a6646518b0d041402428b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9a3da56aae28e1ad3a3e591f72a537742053ecd2",
                    "status": "affected",
                    "version": "c849a6143bec520aff2a6646518b0d041402428b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "edd490b8ad85c052eaf10dcc9f390ea54f1e1b39",
                    "status": "affected",
                    "version": "c849a6143bec520aff2a6646518b0d041402428b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "01eeb601a1626e683fb7b77c63f442b06fb87093",
                    "status": "affected",
                    "version": "c849a6143bec520aff2a6646518b0d041402428b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b85d1000eb8842768970f2fd0a8fd362472d02d5",
                    "status": "affected",
                    "version": "c849a6143bec520aff2a6646518b0d041402428b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "207853d46f7ef2e28042344a1468da8754c3ddbf",
                    "status": "affected",
                    "version": "c849a6143bec520aff2a6646518b0d041402428b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/hid-core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.10"
                  },
                  {
                    "lessThan": "3.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: synchronize input before cleaning up a failed probe\n\nhid_device_io_start() allows reports to run concurrently with probe. If\nthe probe subsequently fails, __hid_device_probe() releases driver\nresources and clears hdev-\u003edriver without first excluding those report\ncallbacks.\n\nFor example, a report may enter hidraw_report_event() while the failure\npath frees the associated hidraw object, leading to a use-after-free when\nthe report takes the object\u0027s list lock.\n\nStop input before performing failed-probe cleanup. This reacquires\ndriver_input_lock and waits for any report callback already in progress."
          }
        ],
        "id": "CVE-2026-90329",
        "lastModified": "2026-09-18T18:17:54.283",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:31.307",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/01eeb601a1626e683fb7b77c63f442b06fb87093"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/207853d46f7ef2e28042344a1468da8754c3ddbf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2c35cdeb13a0c52429501e66f368fa59cad235f6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3ffb088a2ed34ca982cfc2c81d107ce370aa45f1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/98201b46f7e33fe11af6f024fecb40fb56634225"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9a3da56aae28e1ad3a3e591f72a537742053ecd2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b85d1000eb8842768970f2fd0a8fd362472d02d5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/edd490b8ad85c052eaf10dcc9f390ea54f1e1b39"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.