CVE-2026-89623: Linux Kernel HID mcp2221 Use-After-Free

CVE-2026-89623 Overview

CVE-2026-89623 is a use-after-free vulnerability in the Linux kernel's HID mcp2221 driver. The flaw stems from a race condition between incoming Human Interface Device (HID) reports and hardware teardown during probe failure or device removal. The mcp2221_hid_unregister() devres cleanup callback did not quiesce device input/output (I/O) before invoking hid_hw_stop(), allowing HID reports to reach driver structures during dismantling. Kernel maintainers resolved the issue by stopping device I/O at the start of the cleanup callback and guarding hid_device_io_stop() with the io_started flag to preserve probe-failure balancing without emitting spurious warnings on normal removal.

Critical Impact
A local attacker with the ability to trigger driver probe failure or removal on a system with an attached MCP2221 USB HID device could exploit the race to achieve use-after-free memory corruption in kernel space.

Affected Products

Linux kernel builds compiling the HID mcp2221 driver (drivers/hid/hid-mcp2221.c)
Distributions shipping stable kernels prior to the fixes referenced in commits 0ae90a1, 2eda151, 85d9634, c99ba6c, and dca1516
Systems with Microchip MCP2221/MCP2221A USB-to-I2C/UART bridge devices attached

Discovery Timeline

2026-09-11 - CVE-2026-89623 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89623

Vulnerability Analysis

The vulnerability is a use-after-free race condition in the hid-mcp2221 driver's device-managed cleanup path. When the driver's probe routine fails or the device is removed, the devres framework invokes mcp2221_hid_unregister() to tear down HID state. Before the fix, this callback proceeded directly to hid_hw_stop() without first ensuring the HID subsystem had stopped delivering inbound reports.

An in-flight HID report arriving during that window can reference driver-owned structures after they have been freed. The consequence is kernel memory corruption, which can result in denial of service or, depending on the memory layout, escalate to arbitrary kernel-mode code execution.

Root Cause

The root cause is missing I/O quiescence in a devres cleanup callback. The mcp2221_hid_unregister() function tore down hardware state without first calling hid_device_io_stop() to block further report delivery. The fix adds this call at the start of the callback and guards it with the io_started flag so that the normal removal path (where hid_device_remove() has already cleared io_started) does not trigger a spurious "io already stopped" warning, while the probe-failure path still receives correct balancing.

Attack Vector

Exploitation requires local access to a system with an attached MCP2221 device and the ability to influence driver probe or removal timing. An attacker who can force probe failure or trigger removal, combined with the ability to send crafted HID traffic through the USB device, can race the cleanup callback. The vulnerability is not remotely exploitable over a network and requires physical or privileged local proximity to the affected USB peripheral.

See the upstream fixes in Kernel Patch Commit 0ae90a1 and Kernel Patch Commit dca1516 for the code-level change.

Detection Methods for CVE-2026-89623

Indicators of Compromise

Kernel log entries referencing hid-mcp2221 probe failures followed by oops, general protection fault, or KASAN use-after-free reports
Unexpected kernel panics or crashes correlated with USB device attach, detach, or hotplug events involving Microchip MCP2221/MCP2221A bridges
Repeated warnings from the HID core such as "io already stopped" that indicate abnormal driver state transitions

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test builds to surface use-after-free access patterns in the hid-mcp2221 cleanup path
Audit installed kernel package versions against the fixed stable branches referenced in the upstream commits
Monitor USB device inventory to identify hosts with MCP2221 hardware attached and prioritize them for patching

Monitoring Recommendations

Ingest dmesg and journald kernel logs into a centralized log platform and alert on hid-mcp2221, KASAN, and use-after-free strings
Track USB hotplug and driver bind/unbind events via udev monitoring to correlate crashes with device lifecycle changes
Establish baseline kernel version inventories across the fleet and flag hosts running unpatched builds

How to Mitigate CVE-2026-89623

Immediate Actions Required

Identify all Linux hosts running kernels that predate the fixes referenced in the linked stable commits and prioritize kernel updates
Physically remove or unbind MCP2221 devices from systems that cannot be patched immediately, particularly in multi-user environments
Restrict physical and administrative access to systems with attached MCP2221 hardware to limit local attack opportunities

Patch Information

The fix has been merged into the mainline and multiple stable Linux kernel branches. Apply the vendor-supplied kernel update from your distribution, or rebuild from the upstream stable branches containing commits 0ae90a1, 2eda151, 85d9634, c99ba6c, and dca1516. Reboot to activate the new kernel after installation.

Workarounds

Blacklist the hid-mcp2221 module on hosts that do not require MCP2221 functionality by adding blacklist hid-mcp2221 to a file under /etc/modprobe.d/
Unload the running module with modprobe -r hid-mcp2221 after ensuring no dependent services are in use
Enforce USB device allowlisting through tooling such as USBGuard to prevent attachment of MCP2221 devices on unpatched hosts

bash

# Configuration example: blacklist the vulnerable driver until patched
echo 'blacklist hid-mcp2221' | sudo tee /etc/modprobe.d/blacklist-mcp2221.conf
sudo modprobe -r hid-mcp2221
sudo update-initramfs -u