{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97967", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.206Z", "datePublished": "2026-09-25T10:23:09.140Z", "dateUpdated": "2026-09-25T10:23:09.140Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T10:23:09.140Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (corsair-cpro) Remove debugfs entries when probe fails\n\nccp_debugfs_init() registers debugfs files whose private data is the devm\nallocated ccp. If hwmon_device_register_with_info() fails right after it,\nccp_probe() returns without removing them: the HID core then frees ccp,\nand ccp_remove() is not called for a failed probe, so the files stay\nbehind. Reading one of them dereferences the freed pointer.\n\nRemove the debugfs entries on that error path. debugfs_remove_recursive()\nwaits for readers already inside the show callbacks, so ccp is no longer\nreachable through debugfs by the time probe returns."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hwmon/corsair-cpro.c"], "versions": [{"version": "5997eb60f896830126bc1783465b678b110e2fdd", "lessThan": "ae01aafd8214e48cb7eff11e92dfbf3778d52d9d", "status": "affected", "versionType": "git"}, {"version": "5997eb60f896830126bc1783465b678b110e2fdd", "lessThan": "a5de53b08cc319dadce6fb68d33749ea37962952", "status": "affected", "versionType": "git"}, {"version": "5997eb60f896830126bc1783465b678b110e2fdd", "lessThan": "fdc1bc23ff59ee308042342cefcb918d6efba409", "status": "affected", "versionType": "git"}, {"version": "5997eb60f896830126bc1783465b678b110e2fdd", "lessThan": "4ee875c423c66c45d7ef7bbff403cd0e3971e0a2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hwmon/corsair-cpro.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.3-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ae01aafd8214e48cb7eff11e92dfbf3778d52d9d"}, {"url": "https://git.kernel.org/stable/c/a5de53b08cc319dadce6fb68d33749ea37962952"}, {"url": "https://git.kernel.org/stable/c/fdc1bc23ff59ee308042342cefcb918d6efba409"}, {"url": "https://git.kernel.org/stable/c/4ee875c423c66c45d7ef7bbff403cd0e3971e0a2"}], "title": "hwmon: (corsair-cpro) Remove debugfs entries when probe fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hwmon/corsair-cpro.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ae01aafd8214e48cb7eff11e92dfbf3778d52d9d", "status": "affected", "version": "5997eb60f896830126bc1783465b678b110e2fdd", "versionType": "git"}, {"lessThan": "a5de53b08cc319dadce6fb68d33749ea37962952", "status": "affected", "version": "5997eb60f896830126bc1783465b678b110e2fdd", "versionType": "git"}, {"lessThan": "fdc1bc23ff59ee308042342cefcb918d6efba409", "status": "affected", "version": "5997eb60f896830126bc1783465b678b110e2fdd", "versionType": "git"}, {"lessThan": "4ee875c423c66c45d7ef7bbff403cd0e3971e0a2", "status": "affected", "version": "5997eb60f896830126bc1783465b678b110e2fdd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hwmon/corsair-cpro.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (corsair-cpro) Remove debugfs entries when probe fails\n\nccp_debugfs_init() registers debugfs files whose private data is the devm\nallocated ccp. If hwmon_device_register_with_info() fails right after it,\nccp_probe() returns without removing them: the HID core then frees ccp,\nand ccp_remove() is not called for a failed probe, so the files stay\nbehind. Reading one of them dereferences the freed pointer.\n\nRemove the debugfs entries on that error path. debugfs_remove_recursive()\nwaits for readers already inside the show callbacks, so ccp is no longer\nreachable through debugfs by the time probe returns."}], "id": "CVE-2026-97967", "lastModified": "2026-09-25T11:17:24.523", "metrics": {}, "published": "2026-09-25T11:17:24.523", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ee875c423c66c45d7ef7bbff403cd0e3971e0a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a5de53b08cc319dadce6fb68d33749ea37962952"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae01aafd8214e48cb7eff11e92dfbf3778d52d9d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fdc1bc23ff59ee308042342cefcb918d6efba409"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: hwmon: (corsair-cpro) Remove debugfs entries when probe fails", "id": "2541231", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541231"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nhwmon: (corsair-cpro) Remove debugfs entries when probe fails\nccp_debugfs_init() registers debugfs files whose private data is the devm\nallocated ccp. If hwmon_device_register_with_info() fails right after it,\nccp_probe() returns without removing them: the HID core then frees ccp,\nand ccp_remove() is not called for a failed probe, so the files stay\nbehind. Reading one of them dereferences the freed pointer.\nRemove the debugfs entries on that error path. debugfs_remove_recursive()\nwaits for readers already inside the show callbacks, so ccp is no longer\nreachable through debugfs by the time probe returns.", "A flaw was found in the Linux kernel's Corsair Commander Pro (corsair-cpro) driver. When device initialization fails, the driver does not remove registered debug filesystem (debugfs) entries, leaving behind references to memory that has already been freed. A local user accessing these lingering entries can trigger a use-after-free condition, leading to a system crash and Denial of Service (DoS) or memory corruption."], "name": "CVE-2026-97967", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97967\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97967\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97967.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5997eb60f896830126bc1783465b678b110e2fdd,ae01aafd8214e48cb7eff11e92dfbf3778d52d9d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5997eb60f896830126bc1783465b678b110e2fdd,a5de53b08cc319dadce6fb68d33749ea37962952)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5997eb60f896830126bc1783465b678b110e2fdd,fdc1bc23ff59ee308042342cefcb918d6efba409)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5997eb60f896830126bc1783465b678b110e2fdd,4ee875c423c66c45d7ef7bbff403cd0e3971e0a2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T14:45:18.438636+00:00", "updated": "2026-10-01T06:45:02.276475+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}