CVE-2026-53037
Received Received - Intake
Deadlock in Linux Kernel USB HID Driver

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix deadlock in hid_post_reset() You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hid_pre_reset() and hid_post_reset() are in the block IO error handling. Hence no memory allocation used in them may do block IO because the IO can deadlock on the mutex held while resetting a device and calling the interface drivers. Use GFP_NOIO for all allocations in them.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-25
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-53037
EUVD
EUVD-2026-38905
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's USB Human Interface Device (HID) driver, specifically in the functions hid_pre_reset() and hid_post_reset(). When a USB device includes both a HID component and a storage or UAS component, these components must be reset together. During the reset process, the functions hid_pre_reset() and hid_post_reset() are involved in block IO error handling and hold a mutex. If memory allocation within these functions performs block IO, it can cause a deadlock because the mutex is already held while resetting the device and calling interface drivers.

The fix involves using GFP_NOIO for all memory allocations in these functions to avoid block IO during the reset process, thereby preventing the deadlock.

Impact Analysis

This vulnerability can cause a deadlock in the Linux kernel when resetting certain USB devices that have both HID and storage or UAS components. The deadlock can lead to system hangs or freezes during device reset operations, potentially affecting system stability and usability.

Mitigation Strategies

The vulnerability in the Linux kernel related to a deadlock in hid_post_reset() has been fixed by ensuring that no memory allocation in hid_pre_reset() and hid_post_reset() performs block IO, using GFP_NOIO for all allocations.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart