CVE-2026-68358

A flaw was found in the Linux kernel's hwmon (nzxt-kraken3) component. A race condition exists where the hid_hw_stop() function does not stop device input/output (IO). This can lead to a use-after-free (UAF) vulnerability if a device probe operation fails after IO has been initiated. This vulnerability could allow a local attacker to potentially cause a denial of service or escalate privileges.

This issue affects NZXT Kraken3 AIO coolers (nzxt-kraken3 hwmon). HID I/O not stopped before hid_hw_stop on probe failure can UAF. Systems without this hardware are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nzxt_kraken3 module from loading. See https://access.redhat.com/solutions/41278 for instructions.