CVE-2026-89626

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: sensor: custom: Fix field sysfs group cleanup on failure

hid_sensor_custom_add_attributes() creates one sysfs group for each custom sensor field. If sysfs_create_group() fails after some groups have already been created, the function returns the error without removing the previously created groups.

Add a local unwind path to remove the groups that were already created. With enable_sensor exposed only after the field attributes are ready, this path can free sensor_inst->fields without leaving enable_sensor able to access pointers into that array.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 11, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-89627In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccat_reporCVE-2026-89628In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picCVE-2026-89629In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before readCVE-2026-89637.5Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.CVE-2026-896309.1In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data_offset bound in is_valid_oplock_break() CVE-2026-896319.1In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too smaCVE-2026-896328.2In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_pCVE-2026-896339.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesceCVE-2026-896349.1In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_data() error context loop CVE-2026-896359.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect CVE-2026-896369.8In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees aCVE-2026-896379.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malform
CVE-2026-89626: High severity, CVSS 8.8 | Vulnix