CVE-2026-68361

A flaw was found in the Linux kernel's hwmon (corsair-psu) module. A race condition exists where the hid_hw_stop() function fails to stop device input/output (I/O) operations before memory is deallocated. This can occur during the corsairpsu_probe() failure path, allowing the hid_input_report() function to access memory that has already been freed. This use-after-free vulnerability could allow a local attacker to cause a system crash (denial of service) or potentially execute arbitrary code.

This vulnerability presents minimal risk in Red Hat environments because exploitation requires physical connection of specialized Corsair power supply hardware or local emulation of such USB devices during device initialization failures. Furthermore, supported Red Hat Enterprise Linux kernels do not ship the vulnerable code path. Even where such drivers are present in custom configurations, triggering the issue requires local access to induce hardware probe errors, limiting practical exposure under standard enterprise deployments.