CVE-2026-97967
Received Received - Intake

hwmon: Corsair Commander Pro debugfs use-after-free fix

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Remove debugfs entries when probe fails ccp_debugfs_init() registers debugfs files whose private data is the devm allocated ccp. If hwmon_device_register_with_info() fails right after it, ccp_probe() returns without removing them: the HID core then frees ccp, and ccp_remove() is not called for a failed probe, so the files stay behind. Reading one of them dereferences the freed pointer. Remove the debugfs entries on that error path. debugfs_remove_recursive() waits for readers already inside the show callbacks, so ccp is no longer reachable through debugfs by the time probe returns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97967
EUVD
EUVD-2026-86821

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves debugfs entries not being properly removed when a device probe fails. The ccp_debugfs_init function registers debugfs files linked to device memory. If a subsequent step fails, the probe exits without cleaning up these files. This leaves dangling references where reading the files could access freed memory, causing potential crashes or undefined behavior.

Detection Guidance

This vulnerability may leave debugfs entries behind after a failed probe in the Linux kernel's hwmon subsystem. To detect it, check for lingering debugfs files under /sys/kernel/debug related to Corsair CPro hardware monitoring. Look for files that may reference freed memory or show errors when read.

Impact Analysis

This vulnerability could lead to system instability if an attacker triggers the debugfs file reads after memory is freed. It may cause crashes, data corruption, or privilege escalation in systems using the affected Linux kernel component.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a memory safety issue in the Linux kernel's hwmon subsystem where debugfs entries may remain after a failed probe, potentially leading to use-after-free scenarios. No evidence suggests this impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If you cannot update immediately, monitor for debugfs entries related to Corsair CPro and remove them manually if they appear after a failed probe.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97967. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart