CVE-2026-68443

A flaw was found in the Linux kernel's gigabyte_waterforce hwmon driver. A race condition exists because hid_hw_stop() does not properly stop device I/O. This can occur during a driver probe failure after I/O has been initiated, leading to a Use-After-Free (UAF) vulnerability. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.

This issue affects Gigabyte Waterforce AIO coolers using the gigabyte_waterforce hwmon driver. hid_hw_stop() does not stop device I/O, so probe failure after io start can race with hid_input_report() causing use-after-free. Systems without this hardware are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the gigabyte_waterforce module from loading. See https://access.redhat.com/solutions/41278 for instructions.