Is CVE-2026-93826 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93826 being exploited in the wild.

How severe is CVE-2026-93826?

High severity, with a CVSS score of 7.5, published 24 September 2026.

Which products and versions are affected?

Linux kernel multiple versions (fix backported to stable branches).

Is there a fix for CVE-2026-93826?

A patch was published on 2026-06-12: Upstream fix committed by Jiri Kosina Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93826 attacked?

It is attacked with local access or from the adjacent network, in an operating system.

Am I affected by CVE-2026-93826?

Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93826: Linux kernel HID subsystem use-after-free in hidpp_connect_event

CVE-2026-93826 · Severity: high · CVSS 7.5 · Published 2026-09-24

The Linux kernel's HID (Human Interface Device) subsystem, which handles input devices like keyboards and mice, contains a use-after-free vulnerability in the Logitech HID++ driver. If device input registration fails, the driver frees the device but retains a stale pointer, which could be dereferenced later, potentially allowing an attacker to read memory or cause a kernel crash.

Technologies: Linux kernel.

Quick answers

Is CVE-2026-93826 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93826 being exploited in the wild.
How severe is CVE-2026-93826?: High severity, with a CVSS score of 7.5, published 24 September 2026.
Which products and versions are affected?: Linux kernel multiple versions (fix backported to stable branches).
Is there a fix for CVE-2026-93826?: A patch was published on 2026-06-12: Upstream fix committed by Jiri Kosina Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93826 attacked?: It is attacked with local access or from the adjacent network, in an operating system.
Am I affected by CVE-2026-93826?: Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free exists in hidpp_connect_event() in drivers/hid/hid-logitech-hidpp.c: when input_register_device() fails, input_free_device() is called but the hidpp->input pointer is not cleared, leaving a dangling reference to freed memory. An attacker with local access to trigger device connection events (by plugging in a specially crafted HID device) could dereference the stale pointer. The fix resets the pointer to NULL before returning from the error path.

Affected products

Linux kernel multiple versions (fix backported to stable branches)

Timeline

2026-09-24: disclosed: Published on NVD
2026-06-12: patched: Upstream fix committed by Jiri Kosina

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.