---
title: "CVE-2026-93189: Linux Kernel HID - Use After Free"
description: "Linux kernel contains a use-after-free vulnerability in HID subsystem caused by missing input quiescence in hid_hw_stop(), letting attackers cause memory corruption via in-flight HID reports during driver probe failure, exploit requires driver probe failure with in-flight HID reports."
url: https://panop.io/threat-heartbeat/CVE-2026-93189/
---

# CVE-2026-93189 Linux Kernel HID - Use After Free

Linux kernel contains a use-after-free vulnerability in HID subsystem caused by missing input quiescence in hid\_hw\_stop(), letting attackers cause memory corruption via in-flight HID reports during driver probe failure, exploit requires driver probe failure with in-flight HID reports.

CVSS base score 8.8 /10

High

CISA KEV

Not listed

Public exploit

None known

EPSS

0.31% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-93189)

## Details

Type

Use After Free

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

17 September 2026

Updated

15 October 2026

## Vendor fix

Update to the Linux kernel version including the fix that centralizes input quiescence in hid\_hw\_stop() to prevent use-after-free.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-93189](https://nvd.nist.gov/vuln/detail/CVE-2026-93189)
- [https://git.kernel.org/stable/c/c876c437d188911685d8bed645416f2e86bd0354](https://git.kernel.org/stable/c/c876c437d188911685d8bed645416f2e86bd0354)
- [https://git.kernel.org/stable/c/02246d8b462fd9bd90bc7ae7d6cab1acf69bcb87](https://git.kernel.org/stable/c/02246d8b462fd9bd90bc7ae7d6cab1acf69bcb87)
- [https://git.kernel.org/stable/c/0744cb9520aade37e78f69134f3111086158f1d2](https://git.kernel.org/stable/c/0744cb9520aade37e78f69134f3111086158f1d2)
- [https://git.kernel.org/stable/c/0fecd89f979a8653b9a5b0816570329b7a94a081](https://git.kernel.org/stable/c/0fecd89f979a8653b9a5b0816570329b7a94a081)
- [https://git.kernel.org/stable/c/544ebb25bd58f67e821573412ab7a982b9e02211](https://git.kernel.org/stable/c/544ebb25bd58f67e821573412ab7a982b9e02211)
- [https://git.kernel.org/stable/c/6787f1828f5616f17250e108c0031fb96fd2cfe6](https://git.kernel.org/stable/c/6787f1828f5616f17250e108c0031fb96fd2cfe6)
- [https://git.kernel.org/stable/c/92cca302a4eaf65d1b38b3fb600b4ee5eb856a51](https://git.kernel.org/stable/c/92cca302a4eaf65d1b38b3fb600b4ee5eb856a51)
- [https://git.kernel.org/stable/c/a4bc41504690b7d7064931909874f5b98cd148b6](https://git.kernel.org/stable/c/a4bc41504690b7d7064931909874f5b98cd148b6)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)