CVE-2026-89623

Received Received - Intake

HID Device IO Stop Race Condition in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hid_hw_stop Quiesce device IO at the start of the devm cleanup callback mcp2221_hid_unregister() so that incoming HID reports cannot race with hardware teardown during probe failure or device removal, addressing a potential use-after-free. Guard the call to hid_device_io_stop() with io_started. On normal removal hid_device_remove() has already cleared io_started before the devres group is released, so an unconditional call would otherwise hit the !io_started path and emit a spurious "io already stopped" warning on every removal. The guard preserves the probe-failure balancing, where io_started is still set after hid_device_io_start(), while staying silent on the normal removal path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89623

EUVD

EUVD-2026-76535

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a potential use-after-free issue in the HID MCP2221 driver. The problem occurs during device removal or probe failure when incoming HID reports race with hardware teardown. The fix ensures device IO is stopped early in the cleanup process to prevent this race condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID mcp2221 driver and relates to a use-after-free issue during device removal or probe failure. Detection requires checking the kernel version and driver state rather than network scanning. Use uname -a to check your kernel version and grep for mcp2221 in lsmod to see if the driver is loaded.

Impact Analysis

This vulnerability could lead to system instability or crashes if exploited. It may cause use-after-free errors, which can corrupt memory and potentially allow arbitrary code execution. Systems using the affected HID MCP2221 driver are at risk during device removal or failure scenarios.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's HID driver for MCP2221 devices, which could lead to system instability or crashes but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Mitigation involves updating the Linux kernel to a patched version that includes the fix for this vulnerability. Check your distribution's updates and apply the latest kernel patches. If you cannot update immediately, avoid removing or probing mcp2221 devices until the patch is applied.

Hi! I’m here to help you understand CVE-2026-89623. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70