What is the CVSS score of CVE-2026-93189?

CVE-2026-93189 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-93189?

Within 24 hours, inventory Linux assets and confirm whether the affected HID drivers (corsair-psu, corsair-cpro, nzxt-kraken3, nzxt-smart2, gigabyte_waterforce, hid-logitech-dj, hid-nintendo, hid-mcp2221) are loaded or built into the kernel, and restrict local USB/device-attach access to trusted users. Within 7 days, apply the vendor-released Linux kernel patch specified in your Linux distribution vendor's advisory for CVE-2026-93189 and reboot affected systems to load the fixed kernel; if your vendor's fixed kernel version is not yet staged, treat the patch as available per vendor advisory and schedule emergency maintenance. Within 30 days, verify patch compliance across servers, workstations, kiosks, and edge devices, remove or blacklist unused affected HID modules as a defense-in-depth measure, and monitor for kernel crashes or suspicious local device activity.

Linux Kernel CVE-2026-93189

EUVD-2026-82297 HIGH

2026-09-17 Linux

GHSA-c7vq-j3hm-m6qq

Denial Of Service Linux Suse

8.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attach crafted HID device (local/USB-emulated)
Delivery

Bind to affected HID driver, io_start enables input
Exploit

Trigger probe failure at later init step
Execution

hid_hw_stop frees hidraw while reports in flight
Persist

Concurrent hidraw_report_event derefs freed object
Impact

Use-after-free kernel crash (DoS)

Vulnerability Assessment

Exploitation Conditions	Requires the ability to attach a HID device that binds to one of the 8 affected drivers (corsair-psu, corsair-cpro, nzxt-kraken3, nzxt-smart2, gigabyte_waterforce, hid-logitech-dj, hid-nintendo, hid-mcp2221) - via physical USB/Bluetooth or a local USB-gadget emulator - AND driving that driver's probe to fail at an initialization step AFTER hid_device_io_start() enabled input delivery. The UAF only fires as a race: an in-flight HID report must be executing hidraw_report_event() on another CPU during the hid_hw_stop() unwind. Limiting factors: physical/local device-attach access is needed (not remote), the probe must fail at exactly the right point, and the timing window is narrow, making reliable exploitation difficult. The 7 drivers that already call hid_device_io_stop() are unaffected.
Impact	Real-world risk is LOWER than the vendor CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) suggests. The vector is internally inconsistent with the description: AV:A (adjacent network) and AC:L are not credible for a HID driver probe-error race. HID probe runs on local/physical device attach (or a local USB-emulation harness such as the syzbot raw-gadget setup that found it), not over an adjacent network, and the flaw is an inherently timing-dependent race (in-flight HID reports on another CPU dereferencing a freed hidraw during probe unwind), which argues for AC:H, not AC:L. No EPSS score, no CISA KEV entry, and no public proof-of-concept are provided; syzbot is a fuzzer crash reproducer, not a weaponized exploit. Practically this is a use-after-free that is crash-primary (DoS) and requires the driver's probe to fail at a specific later init step after io_start - a narrow, hard-to-steer condition. Treat as a moderate local DoS/UAF, not a network-exploitable critical; verify the attack vector with the vendor before prioritizing on the 8.8 alone.
Exploit ScenarioDerived	An attacker with the ability to attach a HID device (physical USB, Bluetooth HID, or a local USB-gadget/raw-gadget emulator) presents a device that binds to one of the affected drivers (e.g. corsair-psu, hid-logitech-dj, hid-nintendo) and forces its probe to fail after input delivery was enabled. While the probe error path tears down and frees the hidraw object, in-flight HID reports still executing on another CPU dereference the freed memory, causing a use-after-free. No public exploit exists; syzbot demonstrated the crash for the corsair-psu driver via fuzzing.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

Use-after-free in the Linux kernel HID core (hid_hw_stop()) can be triggered when a HID driver's probe enables input delivery via hid_device_io_start() and then fails a later initialization step, unwinding through hid_hw_stop(); the unwind frees the hidraw structure via hidraw_disconnect() while an in-flight report on another CPU may still dereference it through hidraw_report_event(). Roughly half of all hid_device_io_start() callers are exposed, with eight drivers named (corsair-psu, corsair-cpro, nzxt-kraken3, nzxt-smart2, gigabyte_waterforce, hid-logitech-dj, hid-nintendo, hid-mcp2221), while the seven callers that already pair the call with hid_device_io_stop() are unaffected. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the vendor advisory rates this 8.8, but our independent assessment places real-world risk lower (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) because the attacker must have local device-attach capability and must win a narrow race during a probe failure.

RemediationAI

Vendor-released patch: upgrade to the fixed stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 or 7.2.6 (or later, with the fix entering mainline as 7.3-rc1); each stable commit listed in the references carries the centralized hid_hw_stop() quiesce and can be cherry-picked if you maintain a downstream kernel. Because the assessed exploitation vector is local (AV:L, AC:H, PR:L), the practical compensating controls are about denying hostile HID devices rather than blocking network access: blacklist or do not load the eight affected modules (corsair-psu, corsair-cpro, nzxt-kraken3, nzxt-smart2, gigabyte_waterforce, hid-logitech-dj, hid-nintendo, hid-mcp2221) via modprobe.d or a modules_deny list - the trade-off is complete loss of those devices' HWMON telemetry, Logitech Unifying/Bluetooth receiver support and Nintendo controller support; enforce physical USB port control with USBGuard or equivalent allow-listing of known devices, which will not help where users are expected to attach arbitrary peripherals; and disable the dummy_hcd/usb_raw_gadget test facilities on hosts where local users could emulate the required USB device, since that capability is what turns an unprivileged local user into one who can reach the vulnerable probe path. Alternatively, if a driver such as corsair-psu must stay loaded on an unpatched kernel, the per-driver fix that inserts an explicit hid_device_io_stop() before hid_hw_stop() in the probe error path can be applied alone, but note it does not protect the other seven drivers. There is no vendor-issued configuration toggle that removes the race condition itself, so patching remains the only complete remedy.

Affected VersionsENISA

Linux patch: 6.1.188

Linux patch: 6.12.110

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <544ebb25bd58f67e821573412ab7a982b9e02211

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <c876c437d188911685d8bed645416f2e86bd0354

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0744cb9520aade37e78f69134f3111086158f1d2

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a4bc41504690b7d7064931909874f5b98cd148b6

Linux 0 <6.1.188

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6787f1828f5616f17250e108c0031fb96fd2cfe6

Linux 0 <7.2.6

Linux 0 <6.18.52

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <92cca302a4eaf65d1b38b3fb600b4ee5eb856a51

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <02246d8b462fd9bd90bc7ae7d6cab1acf69bcb87

Linux 0 <6.12.110

Linux patch: 6.6.157

Linux patch: 5.10.270

Linux 0 <6.6.157

Linux patch: 6.18.52

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0fecd89f979a8653b9a5b0816570329b7a94a081

Linux patch: 7.2.6

Linux 0 <5.10.270

Linux patch: 5.15.221

Linux 0 <5.15.221

Linux patch: 7.3-rc1

Affected Packages

euvd linux fix: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The HID core provides hid_device_io_start()/hid_device_io_stop() to gate whether in-flight reports from a device are delivered to the driver during probe. Drivers that call hid_device_io_start() and then fail a subsequent initialization step unwind through hid_hw_stop(), which calls hid_disconnect() and hidraw_disconnect(); the latter frees struct hidraw. If report processing is concurrently running on another CPU and reaches hidraw_report_event(), it dereferences the just-freed hidraw object - a classic use-after-free race (root-cause class CWE-416, though the CWE field in the source data is empty). The defect is a class-wide API misuse rather than a single bad commit: auditing the tree found 15 drivers calling hid_device_io_start(), of which 7 correctly pair it with hid_device_io_stop() and 8 do not, so the upstream fix centralizes the quiesce inside hid_hw_stop() - if hdev->io_started is still true on entry, hid_device_io_stop() is invoked before hid_disconnect(), which is a no-op guard for the correctly written drivers. There is no Fixes: tag because the eight drivers acquired their io_start() calls independently over years. CPE data (cpe:2.3:a:linux:linux) confirms the generic Linux kernel as the affected product; peripheral support for the affected hardware (Corsair PSU/CPC HWMON, NZXT Kraken3/Smart2, Gigabyte Waterforce, Logitech DJ receivers, Nintendo controllers, MCP2221 USB-I2C bridges) determines exposure. The original report came from syzbot kernel fuzzing against the corsair-psu driver.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 5.8 MEDIUM

Local/physical HID attach not adjacent-network (AV:L, PR:L), race-dependent probe-error path (AC:H); crash-primary UAF gives A:H with marginal C:L/I:L, not the vendor's C:H/I:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 18, 2026 - 18:22 NVD

8.8 (HIGH)

Patch available

Sep 17, 2026 - 17:19 EUVD

CVE Published

Sep 17, 2026 - 16:12 cve.org

HIGH 8.8

CVE Published

Sep 17, 2026 - 16:12 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

A driver's probe calls hid_device_io_start() to enable input delivery, then fails at a later initialization step and unwinds via hid_hw_stop(). The unwind frees struct hidraw via hidraw_disconnect() while in-flight HID reports may still be running on another CPU, dereferencing the freed object through hidraw_report_event(). syzbot reports the resulting use-after-free for the corsair-psu HID driver.

Edward Adam Davis posted a per-driver fix for corsair-psu that adds an explicit hid_device_io_stop() before hid_hw_stop() in the probe error path ("hwmon: prevent packets from going to driver for probe", 2026-04-28). Auditing the tree shows 15 drivers call hid_device_io_start(); 7 also call hid_device_io_stop() and 8 do not:

drivers calling hid_device_io_start() without a matching hid_device_io_stop() before hid_hw_stop(): drivers/hwmon/corsair-psu.c (fix posted by Edward) drivers/hwmon/corsair-cpro.c drivers/hwmon/nzxt-kraken3.c drivers/hwmon/nzxt-smart2.c drivers/hwmon/gigabyte_waterforce.c drivers/hid/hid-logitech-dj.c drivers/hid/hid-nintendo.c drivers/hid/hid-mcp2221.c

Roughly half of all callers of the API are exposed. Centralize the quiesce in hid_hw_stop() so callers do not have to remember the matching stop: if a driver has left hdev->io_started true on entry, call hid_device_io_stop() before hid_disconnect().

For the 7 drivers that already call hid_device_io_stop() correctly, hdev->io_started is false on entry, the guard short-circuits, and behavior is unchanged.

No Fixes: tag because the affected drivers gained their hid_device_io_start() calls independently over years; the bug is a class-wide API misuse rather than a regression from one commit.

Executive ViewAI

Why It Matters

A use-after-free flaw in the Linux kernel HID subsystem, reachable through several USB/Bluetooth HID drivers, can cause kernel memory corruption, crashes, or potential privilege escalation on affected Linux endpoints, servers, and appliances. Exploitation requires local device-attach capability and low privileges, and no confirmed active exploitation (CISA KEV) or public exploit has been identified, so enterprise-wide risk is lower than the CVSS 8.8 base score suggests. Leadership should still prioritize patching because unpatched Linux fleets used in kiosks, workstations, and edge environments may be exposed to local attackers with physical or virtual device access.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

Medium

HID peripheral drivers (Logitech, Nintendo, NZXT/Corsair) common on Linux desktops/laptops; probe-fail path niche

Data Quality

3 sources

Confidence: Low

EUVD

NVD

CVE.org

EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Controlled

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back