CVE-2026-53037
HID: usbhid: fix deadlock in hid_post_reset()
Description
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix deadlock in hid_post_reset() You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hid_pre_reset() and hid_post_reset() are in the block IO error handling. Hence no memory allocation used in them may do block IO because the IO can deadlock on the mutex held while resetting a device and calling the interface drivers. Use GFP_NOIO for all allocations in them.
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 14, 2026, 7:38 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to the latest version.
- Ensure memory allocations use GFP_NOIO in relevant functions.
- Rebuild and deploy the updated kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53037.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53037 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53037
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53037 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53037 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 14, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-667 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.5 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/4e900465296ce9fb12ed47dc77389b8dde95bfe0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/56d318ef8766f0deb08517fd8f3007256ea7997d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/90550af0aad5e75110073c501e4fb42fca20ff80 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ad4505d2ab3aaac6498f17649608e70e80034bf2 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b3d16611d7cd78e9d5c6baa19b61b7caf9f1ab5e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c7abd0e6c87441e99c759d40eb6fe589634e3041 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/eeceb6f4dd42065fdda3a526a93d08b8fb90fb69 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'dc3c78e43469063c5bf4b744214508f94c4129f9', 'lessThan': '56d318ef8766f0deb08517fd8f3007256ea7997d', 'versionType': 'git'}, {'status': 'affected', 'version': 'dc3c78e43469063c5bf4b744214508f94c4129f9', 'lessThan': '90550af0aad5e75110073c501e4fb42fca20ff80', 'versionType': 'git'}, {'status': 'affected', 'version': 'dc3c78e43469063c5bf4b744214508f94c4129f9', 'lessThan': 'eeceb6f4dd42065fdda3a526a93d08b8fb90fb69', 'versionType': 'git'}, {'status': 'affected', 'version': 'dc3c78e43469063c5bf4b744214508f94c4129f9', 'lessThan': 'ad4505d2ab3aaac6498f17649608e70e80034bf2', 'versionType': 'git'}, {'status': 'affected', 'version': 'dc3c78e43469063c5bf4b744214508f94c4129f9', 'lessThan': '4e900465296ce9fb12ed47dc77389b8dde95bfe0', 'versionType': 'git'}, {'status': 'affected', 'version': 'dc3c78e43469063c5bf4b744214508f94c4129f9', 'lessThan': 'c7abd0e6c87441e99c759d40eb6fe589634e3041', 'versionType': 'git'}, {'status': 'affected', 'version': 'dc3c78e43469063c5bf4b744214508f94c4129f9', 'lessThan': 'b3d16611d7cd78e9d5c6baa19b61b7caf9f1ab5e', 'versionType': 'git'}, {'status': 'affected', 'version': 'dc3c78e43469063c5bf4b744214508f94c4129f9', 'lessThan': '8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72', 'versionType': 'git'}], 'programFiles': ['drivers/hid/usbhid/hid-core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.5'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.5', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/hid/usbhid/hid-core.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix deadlock in hid_post_reset() You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hid_pre_reset() and hid_post_reset() are in the block IO error handling. Hence no memory allocation used in them may do block IO because the IO can deadlock on the mutex held while resetting a device and calling the interface drivers. Use GFP_NOIO for all allocations in them. Added Reference https://git.kernel.org/stable/c/4e900465296ce9fb12ed47dc77389b8dde95bfe0 Added Reference https://git.kernel.org/stable/c/56d318ef8766f0deb08517fd8f3007256ea7997d Added Reference https://git.kernel.org/stable/c/8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72 Added Reference https://git.kernel.org/stable/c/90550af0aad5e75110073c501e4fb42fca20ff80 Added Reference https://git.kernel.org/stable/c/ad4505d2ab3aaac6498f17649608e70e80034bf2 Added Reference https://git.kernel.org/stable/c/b3d16611d7cd78e9d5c6baa19b61b7caf9f1ab5e Added Reference https://git.kernel.org/stable/c/c7abd0e6c87441e99c759d40eb6fe589634e3041 Added Reference https://git.kernel.org/stable/c/eeceb6f4dd42065fdda3a526a93d08b8fb90fb69