CVE-2026-68361: Linux Kernel Race Condition Vulnerability

CVE-2026-68361 Overview

CVE-2026-68361 is a use-after-free vulnerability in the Linux kernel's corsair-psu hwmon driver. The flaw stems from a race condition between hid_input_report() and the probe path when corsairpsu_probe() fails after hid_device_io_start() has been invoked. When the probe fails, hid_hw_stop() frees the hidraw structure while HID input reports may still be in flight, allowing concurrent access to freed memory via hidraw_report_event(). The issue was detected by KASAN as a slab-use-after-free in rt_spin_lock during hidraw's list_lock access. The fix calls hid_device_io_stop() before hid_hw_stop() to close the race window.

Critical Impact
A local race condition in the corsair-psu driver can trigger a kernel use-after-free, leading to memory corruption, potential privilege escalation, or system crash.

Affected Products

Linux kernel versions containing the corsair-psu hwmon driver prior to the fix commits
Systems using Corsair power supply units monitored via the affected hwmon driver
Distributions shipping unpatched stable kernels referenced by commits 9ab8656, bb25bd9, c0aae8d, e6e1e0f, and ec477af

Discovery Timeline

2026-08-10 - CVE-2026-68361 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68361

Vulnerability Analysis

The vulnerability resides in drivers/hwmon/corsair-psu.c within the corsairpsu_probe() function. During probe, the driver calls hid_device_io_start() to unlock driver_input_lock and begin accepting HID input reports. If subsequent probe steps fail, the driver invokes hid_hw_stop() for cleanup, which triggers hid_disconnect() and ultimately hidraw_disconnect() to free the hidraw structure.

Because hid_hw_stop() does not halt device IO, an in-flight hid_irq_in() interrupt path on another CPU can call __hid_input_report() and hidraw_report_event() concurrently. The concurrent path acquires driver_input_lock after the probe path releases it, then dereferences the freed hidraw object's list_lock. This produces a use-after-free condition detectable by KASAN in rt_spin_lock+0x83/0x400.

Root Cause

The root cause is missing IO quiescence before resource teardown. hid_hw_stop() frees the hidraw allocation allocated during hid_connect(), but does not stop the underlying HID device IO started by hid_device_io_start(). This creates a window in which interrupt-driven report processing on one CPU races against probe-failure cleanup on another CPU [Race Condition, Use After Free].

Attack Vector

Exploitation requires local conditions where the corsair-psu probe path fails after IO has been started. A local attacker capable of triggering probe failures on a system with the affected driver, or of controlling HID input timing, could induce the race to corrupt kernel memory. Successful exploitation may lead to kernel memory corruption, denial of service via kernel panic, or, in worst-case scenarios, privilege escalation. Refer to the upstream commits listed under external references for the exact source-level changes: Kernel Commit 9ab8656 and Kernel Commit ec477af.

Detection Methods for CVE-2026-68361

Indicators of Compromise

KASAN reports referencing slab-use-after-free in rt_spin_lock within hidraw_report_event or hid_report_raw_event call stacks
Kernel panics or oopses with call traces including corsairpsu_probe, hid_hw_stop, and hidraw_disconnect
Unexpected corsair-psu module load failures preceded by HID subsystem errors in dmesg

Detection Strategies

Enable KASAN on test kernels to catch use-after-free conditions in the HID and hwmon subsystems
Monitor kernel logs for repeated corsairpsu_probe failures correlated with HID input activity
Track running kernel versions against the upstream fix commits to identify unpatched hosts

Monitoring Recommendations

Ingest kernel logs and audit records into a centralized log analytics platform to correlate driver-level anomalies across the fleet
Alert on kernel oops signatures and KASAN reports referencing hidraw or corsair-psu
Maintain an inventory of Linux kernel versions and loaded drivers to prioritize patch rollout

How to Mitigate CVE-2026-68361

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE, in particular the fix that calls hid_device_io_stop() before hid_hw_stop() in corsairpsu_probe()
Rebuild or update to distribution kernels that include the referenced stable commits
If patching is delayed, unload the corsair-psu module on systems that do not require Corsair PSU telemetry

Patch Information

The fix modifies drivers/hwmon/corsair-psu.c so that when probe fails after hid_device_io_start(), the driver calls hid_device_io_stop() first, clearing the io_started flag under driver_input_lock to prevent races with input reports. Patched stable trees are available in the following commits: Kernel Commit 9ab8656, Kernel Commit bb25bd9, Kernel Commit c0aae8d, Kernel Commit e6e1e0f, and Kernel Commit ec477af.

Workarounds

Blacklist the corsair-psu module via /etc/modprobe.d/ on systems that do not depend on Corsair PSU monitoring
Restrict physical and local access to systems where the driver cannot be disabled to reduce race-triggering opportunities
Prioritize kernel updates on hosts where Corsair PSUs are attached and the driver is actively loaded

bash

# Blacklist the corsair-psu driver until a patched kernel is deployed
echo "blacklist corsair-psu" | sudo tee /etc/modprobe.d/blacklist-corsair-psu.conf
sudo modprobe -r corsair_psu 2>/dev/null || true
sudo update-initramfs -u