CVE-2026-68358

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68358
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68358.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68358
Downstream
Published
2026-08-10T12:03:35.247Z
Modified
2026-08-12T04:19:22.756565536Z
Summary
hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
Details

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (nzxt-kraken3) Stop device IO before calling hidhwstop

Calling hidhwstop() does not stop the device IO. This results in a race condition between hidinputreport() and the point immediately following the execution of hiddeviceio_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.

Fix the problem by calling hiddeviceiostop() before calling hidhw_stop().

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68358.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f3b4b146eb107bda47ee4a8b0927699f962e8a2f
Fixed
8cb282c34d582afcca7b1bae7c7bcd5204fd03d6
Fixed
305c23993e43db9a3681978691b1f9f2a1b26299
Fixed
dc73b0dfeab8dc0fe73e29c4401d032279e23efd
Fixed
f151d0143ac4e086f92f52328ebdbdc50933d8ef

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68358.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.9.0
Fixed
6.12.101
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.42
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68358.json"