Linux Kernel EUVD-2026-38905

The vulnerability resides in the Linux kernel's drivers/hid/usbhid/ subsystem, specifically in the USB interface driver callbacks hid_pre_reset() and hid_post_reset(). CWE-667 (Improper Locking) identifies the root cause class: a deadlock arises when code executing under a held lock attempts an operation that itself requires the same lock or a dependent resource. In this case, when a composite USB device containing both a HID interface and a storage/UAS interface is reset (because both components share a single USB device and must reset together), the reset path operates within block IO error handling while holding a USB reset mutex. The GFP_KERNEL memory allocations inside the reset handlers can invoke the page reclaim subsystem, which may attempt block IO to free memory. That block IO cannot complete while the block IO error handling mutex is held - creating a circular dependency. CPE cpe:2.3:a:linux:linux:* covers all affected kernel versions from the introducing commit dc3c78e43469063c5bf4b744214508f94c4129f9 onward until each respective stable-branch fix commit.