CVE-2026-68360
Received Received - Intake

Race Condition in Corsair Commander Pro Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability. Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68360
EUVD
EUVD-2026-55461

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Use-After-Free (UAF) vulnerability in the Linux kernel's hwmon subsystem, specifically in the Corsair Cpro driver. It occurs due to a race condition caused by improper device IO handling during driver probe failure. The issue arises when hid_hw_stop() is called without first stopping device IO, leading to a situation where the device may still be active while resources are freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's Corsair Cpro hardware monitoring driver. Detection requires checking kernel logs for related errors or examining the driver's probe function behavior. No standard network detection commands apply. Inspect kernel logs with 'dmesg | grep corsair-cpro' or check driver initialization with 'lsmod | grep corsair_cpro'.

Impact Analysis

This vulnerability could allow an attacker to cause system instability, crashes, or potentially execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or unauthorized access if exploited, particularly on systems using the affected Corsair Cpro hardware.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-68360. If using a Corsair Cpro device, ensure the driver is updated. Monitor kernel logs for any related errors after updating.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68360. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart