CVE-2026-93826 - Vulnerability Details

- HID: hidpp: fix potential UAF in hidpp_connect_event()

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: hidpp: fix potential UAF in hidpp_connect_event()

If input_register_device() fails, we call input_free_device(), but keep
stale pointer to the old device in hidpp->input, which could potentially
lead to UAF. Fix that by resetting it to NULL before returning from
hidpp_connect_event().

Published: 2026-09-24

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel HID subsystem contains a use‑after‑free condition in hidpp_connect_event(). If input_register_device() fails, the freed device's pointer remains in hidpp->input and may be dereferenced later, potentially causing a kernel crash. The flaw arises from improper cleanup after a device registration failure, which results in a denial of service.

Affected Systems

All Linux kernel releases prior to commit 3303398cc2aa255ba251650a30024e11d48ea6c3 are affected regardless of distribution or vendor. The vulnerability exists in every kernel that ships the HID driver before this patch.

Risk and Exploitability

Based on the description, it is inferred that the vulnerability requires local access to a USB HID device capable of triggering a registration failure; no remote trigger is described. The EPSS score of < 1% indicates a very low likelihood of exploitation, while the CVSS score of 7.5 reflects high severity. The flaw is not listed in the CISA KEV catalog, and no public exploits are known.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c39e3d5fc9dd3e16c6f59dd94d827540040de66d`	affected	< e03fd646adad7f97fa4429ec5f38cee9bde5276e
`c39e3d5fc9dd3e16c6f59dd94d827540040de66d`	affected	< 5d7637f4d050d105177217e64b869f56f9825060
`c39e3d5fc9dd3e16c6f59dd94d827540040de66d`	affected	< 3b8b2e58b078cd30e121401535541bb8a6d57133
`c39e3d5fc9dd3e16c6f59dd94d827540040de66d`	affected	< 3303398cc2aa255ba251650a30024e11d48ea6c3
`c39e3d5fc9dd3e16c6f59dd94d827540040de66d`	affected	< 6df6b1f2c49678211f65647c300bc51dda02893b

Linux

affected

Version	Status	Constraints
`3.19`	affected	—
`0`	unaffected	< 3.19
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3b8b2e58b078cd30e121401535541bb8a6d57133)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3303398cc2aa255ba251650a30024e11d48ea6c3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6df6b1f2c49678211f65647c300bc51dda02893b)`	affected	code_commit	—
`[0,6.12.111)`	affected	generic	—
`[0,6.18.53)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.12.111,7.0.0)`	unaffected	semver	—
`[6.18.53,7.0.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes commit 3303398cc2aa255ba251650a30024e11d48ea6c3 or later.
If a newer kernel is unavailable, import the relevant patch lines from that commit into your current kernel tree, rebuild, and install the patched kernel.
Reboot after installing the patched kernel to activate the changes.

Generated by OpenCVE AI on October 1, 2026 at 20:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00234.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93826.mbox
https://git.kernel.org/stable/c/3303398cc2aa255ba251650a30024e11d48ea6c3
https://git.kernel.org/stable/c/3b8b2e58b078cd30e121401535541bb8a6d57133
https://git.kernel.org/stable/c/5d7637f4d050d105177217e64b869f56f9825060
https://git.kernel.org/stable/c/6df6b1f2c49678211f65647c300bc51dda02893b
https://git.kernel.org/stable/c/e03fd646adad7f97fa4429ec5f38cee9bde5276e
https://nvd.nist.gov/vuln/detail/CVE-2026-93826
https://www.cve.org/CVERecord?id=CVE-2026-93826

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5d7637f4d050d105177217e64b869f56f9825060 https://git.kernel.org/stable/c/e03fd646adad7f97fa4429ec5f38cee9bde5276e

Thu, 01 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93826.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-93826 https://www.cve.org/CVERecord?id=CVE-2026-93826
Metrics	threat_severity `None`	threat_severity `Moderate`

Fri, 25 Sep 2026 11:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 25 Sep 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 24 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidpp_connect_event() If input_register_device() fails, we call input_free_device(), but keep stale pointer to the old device in hidpp->input, which could potentially lead to UAF. Fix that by resetting it to NULL before returning from hidpp_connect_event().
Title		HID: hidpp: fix potential UAF in hidpp_connect_event()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3303398cc2aa255ba251650a30024e11d48ea6c3 https://git.kernel.org/stable/c/3b8b2e58b078cd30e121401535541bb8a6d57133 https://git.kernel.org/stable/c/6df6b1f2c49678211f65647c300bc51dda02893b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T16:03:04.711Z

Updated: 2026-10-03T10:57:57.986Z

Reserved: 2026-09-18T17:59:28.792Z

Link: CVE-2026-93826

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T17:17:16.297

Modified: 2026-10-03T11:17:52.437

Link: CVE-2026-93826

Redhat

Severity : Moderate

Publid Date: 2026-09-24T00:00:00Z

Links: CVE-2026-93826 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T20:45:12Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object