CVE-2026-68358: Linux Kernel Race Condition Vulnerability

CVE-2026-68358 Overview

CVE-2026-68358 is a use-after-free (UAF) vulnerability in the Linux kernel's nzxt-kraken3 hardware monitoring (hwmon) driver. The flaw exists in the driver probe function, where hid_hw_stop() does not halt device input/output. This creates a race condition between hid_input_report() and the code path immediately following hid_device_io_start(). If the probe operation fails after I/O has been initiated, the race can result in a use-after-free condition. The upstream fix calls hid_device_io_stop() before hid_hw_stop() to properly quiesce device I/O prior to teardown.

Critical Impact
A local attacker with the ability to trigger probe failures on NZXT Kraken 3 HID devices could exploit the race window to corrupt kernel memory, potentially escalating privileges or destabilizing the system.

Affected Products

Linux kernel builds including the nzxt-kraken3 hwmon driver prior to the patched commits
Distributions shipping the vulnerable drivers/hwmon/nzxt-kraken3.c codepath
Systems interacting with NZXT Kraken series HID devices via the affected driver

Discovery Timeline

2026-08-10 - CVE-2026-68358 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68358

Vulnerability Analysis

The vulnerability resides in the probe path of the nzxt-kraken3 hwmon driver. During probe, the driver calls hid_device_io_start() to allow the HID subsystem to begin dispatching input reports. If a subsequent step in the probe function fails, the driver calls hid_hw_stop() to unwind the initialization. However, hid_hw_stop() alone does not guarantee that in-flight hid_input_report() callbacks have completed. A pending report handler can therefore continue to reference driver-owned state after that state has been freed, producing a classic use-after-free condition [CWE-416].

Root Cause

The root cause is missing synchronization between HID input report delivery and driver teardown on the probe error path. hid_device_io_start() opens an I/O window that must be explicitly closed with hid_device_io_stop() before releasing associated resources. The original code skipped that call and relied on hid_hw_stop(), which does not drain outstanding I/O.

Attack Vector

Exploitation requires local presence and interaction with the affected HID device path — typically a physically attached or emulated NZXT Kraken device. An attacker who can force the driver probe to fail after hid_device_io_start() executes may race incoming input reports against the cleanup path, dereferencing freed memory in kernel context.

No public proof-of-concept exploit is available. See the upstream fix commits for implementation detail: Linux Kernel Commit 305c2399, Linux Kernel Commit 8cb282c3, Linux Kernel Commit dc73b0df, and Linux Kernel Commit f151d014.

// No verified exploit code is available for this CVE.
// The fix adds a call to hid_device_io_stop() before hid_hw_stop()
// on the probe error path in drivers/hwmon/nzxt-kraken3.c.

Detection Methods for CVE-2026-68358

Indicators of Compromise

Kernel oops, panic, or KASAN reports referencing nzxt-kraken3, hid_input_report, or the hwmon subsystem
Repeated probe failures for NZXT Kraken HID devices in dmesg output
Unexpected kernel memory corruption warnings on systems with NZXT liquid cooling hardware attached

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in test environments to surface use-after-free access in the nzxt-kraken3 codepath
Inventory running kernel versions against the fixed commit hashes to identify unpatched hosts
Monitor dmesg and journalctl -k for HID probe failure sequences followed by faults in adjacent kernel workers

Monitoring Recommendations

Alert on kernel crash telemetry that references hwmon or hid subsystem functions on servers, workstations, or gaming rigs with NZXT hardware
Track kernel package versions across the fleet and flag hosts running kernels older than the patched stable releases
Correlate USB/HID device attachment events with subsequent kernel instability to identify targeted abuse of the race window

How to Mitigate CVE-2026-68358

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix commits listed in the references
Prioritize patching on multi-user systems and shared workstations where local users could trigger probe conditions
If patching is delayed, restrict physical and USB access to affected hosts to limit HID device attachment

Patch Information

The fix calls hid_device_io_stop() before hid_hw_stop() in the nzxt-kraken3 driver, ensuring that pending HID input reports complete before driver resources are released. The corrective commits are 305c23993e43, 8cb282c34d58, dc73b0dfeab8, and f151d0143ac4 in the stable kernel tree. Apply distribution kernel updates that incorporate these commits.

Workarounds

Unload the nzxt-kraken3 module (modprobe -r nzxt-kraken3) on systems that do not require monitoring of NZXT Kraken hardware
Blacklist the driver via /etc/modprobe.d/ to prevent automatic loading until a patched kernel is deployed
Enforce USB device control policies to block unauthorized HID device attachment on sensitive endpoints

bash

# Blacklist the vulnerable driver until the host is patched
echo 'blacklist nzxt-kraken3' | sudo tee /etc/modprobe.d/blacklist-nzxt-kraken3.conf
sudo modprobe -r nzxt-kraken3 2>/dev/null || true
sudo update-initramfs -u