CVE-2026-53037: Linux Kernel HID USB Deadlock DoS Flaw

CVE-2026-53037 Overview

CVE-2026-53037 affects the Linux kernel's USB Human Interface Device (HID) subsystem. The flaw is a deadlock condition in hid_post_reset() within the usbhid driver. Composite USB devices that bundle a HID interface together with a storage or USB Attached SCSI (UAS) interface must be reset as a single unit. As a result, hid_pre_reset() and hid_post_reset() execute inside the block I/O error handling path. Any memory allocation performed in those handlers that itself triggers block I/O can deadlock on the device reset mutex held by the interface drivers. The fix forces all allocations in those paths to use GFP_NOIO.

Critical Impact
Local conditions involving composite USB HID and storage or UAS devices can deadlock the kernel during device reset, leading to denial of service on affected systems.

Affected Products

Linux kernel — usbhid driver (drivers/hid/usbhid/)
Systems using composite USB devices combining HID with mass storage or UAS
Stable kernel branches addressed across eight upstream commits

Discovery Timeline

2026-06-24 - CVE-2026-53037 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53037

Vulnerability Analysis

The Linux usbhid driver registers hid_pre_reset() and hid_post_reset() callbacks that run when the USB core performs a device reset. For composite USB devices containing both a HID interface and a storage or UAS interface, the reset operation spans all interfaces and is invoked from the block I/O error recovery path. During this path, the kernel cannot safely re-enter block I/O because the device reset mutex is already held.

The original code used standard GFP_KERNEL allocations inside these handlers. GFP_KERNEL permits the memory allocator to reclaim memory by writing dirty pages back to block storage. If that reclaim path targets the same device currently undergoing reset, the allocation blocks on the held mutex and the system deadlocks. This is a classic [CWE-833] deadlock arising from reentrant memory pressure during I/O error handling.

Root Cause

The root cause is incorrect allocation flags in hid_pre_reset() and hid_post_reset(). The handlers requested memory with flags that allow filesystem and block I/O reclaim while running in a context where such I/O cannot complete. The patch replaces these allocations with GFP_NOIO, which prohibits the allocator from triggering block I/O during reclaim and breaks the dependency cycle.

Attack Vector

Exploitation requires physical access to attach a crafted composite USB device that advertises both a HID interface and a storage or UAS interface, then triggers a reset condition. The result is a kernel deadlock affecting availability rather than confidentiality or integrity. The vulnerability is not network-reachable and no public exploit is currently tracked.

No verified code examples are available. Technical detail is documented in the upstream Linux kernel commits referenced below, including Kernel Git Commit 4e90046 and Kernel Git Commit 8df2c1b.

Detection Methods for CVE-2026-53037

Indicators of Compromise

Kernel hang or unresponsive task warnings referencing hid_post_reset, hid_pre_reset, or usbhid in the call stack.
khungtaskd messages or soft lockup traces tied to USB reset operations on composite devices.
Block I/O timeouts on USB mass storage or UAS devices that also expose a HID interface.

Detection Strategies

Inspect dmesg and journalctl -k for stack traces involving usb_reset_device, hid_post_reset, and block layer functions during the same window.
Audit attached USB devices for composite descriptors combining HID with bInterfaceClass 0x08 (Mass Storage) or UAS.
Compare running kernel build hashes against the fixed commits listed in the upstream references.

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on hung_task or INFO: task ... blocked patterns referencing usbhid.
Track USB device insertion events on servers and workstations to flag unexpected composite HID plus storage devices.
Monitor host availability metrics for unexplained I/O stalls correlated with USB hotplug activity.

How to Mitigate CVE-2026-53037

Immediate Actions Required

Update affected systems to a Linux kernel build that includes the usbhidGFP_NOIO fix from the referenced stable commits.
Restrict physical USB port access on production servers and sensitive endpoints to reduce exposure to malicious composite devices.
Identify long-running hosts using composite USB HID plus storage or UAS devices and schedule kernel updates with priority.

Patch Information

The fix has been merged across multiple Linux stable branches. Apply distribution kernel updates that incorporate any of the upstream commits: 4e90046, 56d318e, 8df2c1b, 90550af, ad4505d, b3d1661, c7abd0e, and eeceb6f. The change converts allocations in hid_pre_reset() and hid_post_reset() to GFP_NOIO.

Workarounds

Enforce USB port control with udev rules or USBGuard policies that block composite devices combining HID with storage or UAS classes.
Disable physical USB ports through BIOS or UEFI on systems that do not require user-attached peripherals.
Where kernel updates cannot be applied immediately, avoid hot-plugging multifunction USB devices on critical hosts.

bash

# Example USBGuard policy snippet to block composite HID+MassStorage devices
allow with-interface equals { 03:*:* }
reject with-interface all-of { 03:*:* 08:*:* }
reject with-interface all-of { 03:*:* 08:06:62 }