CVE-2026-68359

What it actually does

Use-after-free in the nzxt-smart2 hwmon driver due to a race between hid_input_report and post-hid_device_io_start code paths when probe fails after IO start has been initiated.

Why it matters to the business

Kernel memory corruption on systems with affected NZXT hardware can lead to crashes, denial of service, or local privilege escalation; low public exploit activity reduces immediate widespread risk but still requires prompt patching on exposed Linux hosts.

How an attack unfolds

An attacker with local access or the ability to influence device probe timing triggers a failed probe after hid_device_io_start, then reuses the still-referenced freed object via a concurrent hid_input_report to achieve arbitrary kernel memory access.

How to fix it

Update to a Linux kernel containing the fix that inserts hid_device_io_stop before hid_hw_stop in the nzxt-smart2 probe error path; rebuild and reboot systems with the patched kernel.

How to confirm the fix worked

Confirm the presence of the hid_device_io_stop call in the nzxt-smart2 driver source or verify the running kernel version includes the upstream commit resolving the race; test probe failure paths with the device attached.

Typical attack path

1. Attach or reset NZXT device to initiate driver probe
2. Force or wait for probe failure after hid_device_io_start
3. Trigger concurrent input report processing to access freed memory
4. Leverage UAF for kernel code execution or privilege escalation

How to detect it

Review kernel logs for oops or panic messages referencing nzxt-smart2, hid_hw_stop, or use-after-free in the hwmon subsystem; correlate with device attach events and failed probe attempts around the time of any instability.

What your security team should do

• Prioritize kernel updates on any Linux systems exposing the nzxt-smart2 driver
• Monitor upstream stable and distribution kernel changelogs for backports
• Restrict unprivileged local access on systems with NZXT hardware until patched
• Include the driver in routine kernel integrity and version scanning