CVE-2026-68359: Linux Kernel Race Condition Vulnerability

CVE-2026-68359 Overview

CVE-2026-68359 is a use-after-free (UAF) vulnerability in the Linux kernel's nzxt-smart2 hwmon driver. The flaw stems from a race condition between hid_input_report() and the driver probe function. The driver calls hid_hw_stop() during error handling, but this function does not stop device I/O. If the probe operation fails after hid_device_io_start() has been invoked, the race condition can trigger a UAF condition in kernel memory.

The upstream fix introduces a call to hid_device_io_stop() before hid_hw_stop() to prevent inbound HID reports from referencing freed driver state.

Critical Impact
Local triggering of the probe failure path can lead to kernel memory corruption via use-after-free, potentially enabling denial of service or privilege escalation on systems with the NZXT Smart Device V2 controller.

Affected Products

Linux kernel versions containing the nzxt-smart2 hwmon driver prior to the fix
Distributions shipping affected stable kernel branches (see kernel.org stable trees)
Systems using NZXT Smart Device V2 HID-based hardware monitoring

Discovery Timeline

2026-08-10 - CVE-2026-68359 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68359

Vulnerability Analysis

The nzxt-smart2 driver is a hardware monitoring (hwmon) driver for NZXT Smart Device V2 fan and RGB controllers. It communicates with the device over the HID (Human Interface Device) transport layer. During probe, the driver enables HID I/O via hid_device_io_start() to begin receiving reports from the device.

When the probe function encounters a failure after I/O has been started, the cleanup path calls hid_hw_stop(). This function tears down the HID hardware layer but does not synchronously halt inbound report delivery. As a result, hid_input_report() can execute concurrently with driver teardown, dereferencing structures that the probe failure path has already freed.

Root Cause

The root cause is improper ordering of teardown operations in the probe error path. The driver assumes hid_hw_stop() is sufficient to quiesce the device, but HID core semantics require an explicit hid_device_io_stop() call to pair with a prior hid_device_io_start(). Without this pairing, a report callback can race with the release of driver-owned memory, producing a use-after-free condition [CWE-416].

Attack Vector

Exploitation requires the presence of a compatible NZXT device and the ability to induce probe failure. A local attacker with physical access, or a malicious USB device presenting the NZXT vendor and product identifiers, could time report delivery to coincide with driver teardown. The vulnerability manifests entirely in kernel context, making successful exploitation dangerous despite the narrow triggering window.

No public proof-of-concept exists. The fix commits are available in the Linux stable kernel tree and describe the corrective ordering.

Detection Methods for CVE-2026-68359

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nzxt_smart2, hid_input_report, or hwmon in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports indicating use-after-free within the HID subsystem during device probe
System crashes correlated with connection or reinitialization of NZXT Smart Device V2 hardware

Detection Strategies

Enumerate loaded kernel modules using lsmod | grep nzxt_smart2 and compare running kernel version against fixed stable releases
Monitor kernel ring buffer for HID subsystem faults and driver probe failures on hosts with NZXT hardware
Track USB device attach events for HID controllers matching the NZXT vendor identifier through auditd or udev logs

Monitoring Recommendations

Aggregate dmesg and journalctl -k output centrally to identify kernel-mode faults across the fleet
Alert on repeated driver probe failures for hwmon HID devices, which may indicate exploitation attempts
Baseline expected USB HID device connections and flag anomalous attach events on servers or workstations

How to Mitigate CVE-2026-68359

Immediate Actions Required

Apply the vendor-supplied kernel update containing the hid_device_io_stop() fix from your Linux distribution
Inventory hosts with NZXT Smart Device V2 hardware and prioritize them for patching
Restrict physical and USB access on affected systems until the patch is deployed

Patch Information

The fix has been merged into the Linux stable kernel trees. Relevant commits include 185c0880397a, 18d7c5238910, 205cff797a94, 59d104b54b0b, and a2a15de02059. Consult your distribution's security advisories for backported package versions.

Workarounds

Blacklist the nzxt_smart2 module on systems that do not require NZXT hardware monitoring by adding blacklist nzxt_smart2 to /etc/modprobe.d/
Physically disconnect NZXT Smart Device V2 controllers from production systems until patching is complete
Enforce USB device allowlisting via udev rules or USBGuard to prevent unauthorized HID devices from binding to the driver

bash

# Configuration example: blacklist the vulnerable driver
echo "blacklist nzxt_smart2" | sudo tee /etc/modprobe.d/blacklist-nzxt-smart2.conf
sudo rmmod nzxt_smart2 2>/dev/null
sudo update-initramfs -u