CVE-2026-53037
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A deadlock vulnerability was found in the Linux kernel's hid_post_reset() function in the HID USB driver. The issue occurs when a USB device includes both a HID component and a storage/UAS component that are reset together. Memory allocations in hid_pre_reset() and hid_post_reset() may perform blocking I/O, leading to a deadlock on the mutex held during device reset.
Risk Assessment
The deadlock can cause system hangs or USB device failures, impacting system availability and potentially leading to data loss for storage devices.
Recommendation
Apply the Linux kernel patch that changes memory allocations in hid_pre_reset() and hid_post_reset() to GFP_NOIO to prevent blocking I/O. Update the kernel to a version containing the fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix deadlock in hid_post_reset() You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hid_pre_reset() and hid_post_reset() are in the block IO error handling. Hence no memory allocation used in them may do block IO because the IO can deadlock on the mutex held while resetting a device and calling the interface drivers. Use GFP_NOIO for all allocations in them.