CVE-2026-68360

A flaw was found in the Linux kernel's hwmon: (corsair-cpro) driver. A race condition can occur during the driver's initialization process if device input/output (IO) is started but then fails. This timing issue can lead to a use-after-free (UAF) vulnerability, where the system attempts to access memory that has already been released. This critical flaw could potentially allow a local attacker to execute arbitrary code or cause a system crash (denial of service).

This issue affects Corsair Commander Pro (corsair-cpro hwmon). HID I/O not stopped before hid_hw_stop on probe failure can UAF. Systems without this hardware are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.