CVE-2026-68360: Linux Kernel Race Condition Vulnerability

CVE-2026-68360 Overview

CVE-2026-68360 is a use-after-free (UAF) vulnerability in the Linux kernel's hwmon subsystem, specifically within the corsair-cpro driver. The flaw arises from a race condition between hid_input_report() and the driver probe function. When the probe operation fails after hid_device_io_start() has been called, the driver invokes hid_hw_stop() without first stopping device IO. This leaves an active input path referencing freed driver state. An attacker with a matching Corsair HID device attached can trigger the failure window and cause memory corruption in kernel context.

Critical Impact
A race between hid_input_report() and driver probe cleanup produces a kernel-mode use-after-free that can lead to memory corruption or local privilege escalation.

Affected Products

Linux kernel builds shipping the hwmoncorsair-cpro driver prior to the fix commits
Distribution kernels that have not backported the upstream patch
Systems with Corsair Commander Pro HID devices attached during driver probe

Discovery Timeline

2026-08-10 - CVE-2026-68360 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68360

Vulnerability Analysis

The corsair-cpro driver binds to Corsair Commander Pro HID devices and exposes hardware monitoring via the kernel hwmon interface. During probe, the driver calls hid_device_io_start() to allow input reports to reach the driver's report parser. If a later step in probe fails, the driver historically called hid_hw_stop() directly to unwind. The problem is that hid_hw_stop() does not quiesce inbound IO; input reports already in flight can continue to be dispatched to the driver.

This creates a race window where hid_input_report() may execute against driver context that the failing probe path is tearing down. The result is a use-after-free [CWE-416] on driver-owned structures. Because the vulnerable path executes in kernel context, successful exploitation can corrupt kernel memory and undermine host integrity.

Root Cause

The root cause is missing IO quiescence in the driver's error path. hid_device_io_start() enables report delivery, but the cleanup sequence in the failure branch calls hid_hw_stop() without a paired hid_device_io_stop(). The fix, applied across the stable branches referenced in commits 0975c42, 1a634f4, 56d2deb, 94c8787, and c7757db, inserts a hid_device_io_stop() call before hid_hw_stop() so inbound reports are halted before driver state is released.

Attack Vector

Exploitation requires local presence of a Corsair HID device and a probe failure condition. An attacker who can attach USB HID devices, or influence probe timing through malformed device descriptors or resource pressure, can widen the race window. Kernel UAF conditions of this class have historically been leveraged for local privilege escalation when combined with heap grooming primitives.

No public proof-of-concept exploit is currently available. See the kernel commit for the corrected teardown sequence.

Detection Methods for CVE-2026-68360

Indicators of Compromise

Kernel oops or panic messages referencing corsair_cpro, hid_input_report, or hid_hw_stop in dmesg and /var/log/kern.log
KASAN reports flagging use-after-free within the hwmon or HID subsystem on affected hosts
Unexpected USB HID connect and disconnect events immediately preceding kernel instability

Detection Strategies

Inventory running kernels and compare against the fixed stable versions containing commits 0975c42, 1a634f4, 56d2deb, 94c8787, and c7757db
Enable KASAN in test builds to catch UAF triggering during hotplug and probe-failure fuzzing of the corsair-cpro driver
Correlate USB device attach events with kernel warnings using host telemetry and SIEM rules

Monitoring Recommendations

Forward kernel ring buffer and journal logs to a centralized data lake and alert on BUG:, KASAN, and general protection fault entries
Monitor USB device enumeration on servers and workstations where Corsair peripherals are not expected
Track kernel version drift across the fleet and flag hosts running unpatched vendor kernels

How to Mitigate CVE-2026-68360

Immediate Actions Required

Apply the vendor kernel update that includes the upstream fix for corsair-cpro probe teardown
Restrict physical and USB access on hosts where the corsair-cpro driver is loaded
Unload the corsair-cpro module on systems that do not require Corsair Commander Pro monitoring

Patch Information

The upstream fix inserts hid_device_io_stop() before hid_hw_stop() in the driver error path. It has been merged into multiple stable branches. Reference commits: 0975c42, 1a634f4, 56d2deb, 94c8787, and c7757db. Distribution maintainers are expected to backport the change; validate that your running kernel includes it.

Workarounds

Blacklist the corsair-cpro module with install corsair_cpro /bin/true in /etc/modprobe.d/ where the driver is not needed
Enforce USB device allowlisting via USBGuard to block unauthorized HID attachments that could influence probe timing
Limit local user access on shared systems until the patched kernel is deployed

bash

# Configuration example
# Disable the corsair-cpro driver on hosts that do not require it
echo 'blacklist corsair_cpro' | sudo tee /etc/modprobe.d/disable-corsair-cpro.conf
sudo rmmod corsair_cpro 2>/dev/null || true
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep corsair_cpro