# CVE-2026-90329

Linux HID race causes kernel use-after-free enabling kernel-level RCE via malicious HID reports

- Page: https://www.vulneraibility.com/cve/CVE-2026-90329
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.34% (percentile 28.0)
- Published: 2026-09-17

## Affected versions

- Linux: affected >= c849a6143bec520aff2a6646518b0d041402428b and < 3ffb088a2ed34ca982cfc2c81d107ce370aa45f1; >= c849a6143bec520aff2a6646518b0d041402428b and < 2c35cdeb13a0c52429501e66f368fa59cad235f6; >= c849a6143bec520aff2a6646518b0d041402428b and < 98201b46f7e33fe11af6f024fecb40fb56634225; >= c849a6143bec520aff2a6646518b0d041402428b and < 9a3da56aae28e1ad3a3e591f72a537742053ecd2; >= c849a6143bec520aff2a6646518b0d041402428b and < edd490b8ad85c052eaf10dcc9f390ea54f1e1b39; >= c849a6143bec520aff2a6646518b0d041402428b and < 01eeb601a1626e683fb7b77c63f442b06fb87093; >= c849a6143bec520aff2a6646518b0d041402428b and < b85d1000eb8842768970f2fd0a8fd362472d02d5; >= c849a6143bec520aff2a6646518b0d041402428b and < 207853d46f7ef2e28042344a1468da8754c3ddbf; 3.10; fixed in < 3.10, >= 5.10.270 and <= 5.10.*, >= 5.15.221 and <= 5.15.*, >= 6.1.188 and <= 6.1.*, >= 6.6.157 and <= 6.6.*, >= 6.12.110 and <= 6.12.*, >= 6.18.52 and <= 6.18.*, >= 7.2.6 and <= 7.2.*, >= 7.3-rc1 and <= *

A version outside these ranges is not a statement that it is unaffected.

## Impact

Concurrent HID report callbacks can trigger a use-after-free, allowing a local/physical attacker with a malicious HID (USB/Bluetooth) to achieve kernel RCE or privilege escalation.

## Action

Immediate action required

## Recommendation

Install vendor kernel updates with the HID fixes and block untrusted HID devices

## References

- [other] https://git.kernel.org/stable/c/3ffb088a2ed34ca982cfc2c81d107ce370aa45f1
- [other] https://git.kernel.org/stable/c/2c35cdeb13a0c52429501e66f368fa59cad235f6
- [other] https://git.kernel.org/stable/c/98201b46f7e33fe11af6f024fecb40fb56634225
- [other] https://git.kernel.org/stable/c/9a3da56aae28e1ad3a3e591f72a537742053ecd2
- [other] https://git.kernel.org/stable/c/edd490b8ad85c052eaf10dcc9f390ea54f1e1b39
- [other] https://git.kernel.org/stable/c/01eeb601a1626e683fb7b77c63f442b06fb87093
- [other] https://git.kernel.org/stable/c/b85d1000eb8842768970f2fd0a8fd362472d02d5
- [other] https://git.kernel.org/stable/c/207853d46f7ef2e28042344a1468da8754c3ddbf

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.