CVE-2026-93826

Received Received - Intake

HIDPP UAF Fix in Linux Kernel Input Subsystem

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidpp_connect_event() If input_register_device() fails, we call input_free_device(), but keep stale pointer to the old device in hidpp->input, which could potentially lead to UAF. Fix that by resetting it to NULL before returning from hidpp_connect_event().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-93826

EUVD

EUVD-2026-86215

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's HID++ driver. It occurs when input_register_device() fails during device connection. The driver calls input_free_device() but does not clear the stale device pointer in hidpp->input, which could lead to accessing freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID++ subsystem and does not have network-based detection methods. It requires checking kernel logs for input device registration failures or examining the hidpp_connect_event() function in the kernel source code for potential UAF conditions.

Impact Analysis

This vulnerability could cause system crashes or unexpected behavior if exploited. It may allow local attackers to escalate privileges or execute arbitrary code on affected systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory management issue with no documented impact on data protection or privacy controls.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to ensure the fix for hidpp_connect_event() is included. Monitor kernel logs for input device registration errors as a potential indicator of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-93826. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70