Answer in brief
CVE-2026-89623 records a Unknown severity vulnerability in HID: mcp2221: stop device IO before hid_hw_stop. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d4b50ac06ea6e47bdd2b04e97d1090c673c80645 <85d963499f1feeea287c0a37c3eac3fc1898eca9 || >=73ce9f1f2741a38f5d27393e627702ae2c46e6f2 <0ae90a19e6b5a8557d25d95facb7e01c9c07af38 || >=73ce9f1f2741a38f5d27393e627702ae2c46e6f2 <c99ba6c234d4d537c317336376b78c088174034a || >=73ce9f1f2741a38f5d27393e627702ae2c46e6f2 <2eda1513f573945c1e3a0090341f3d28740463b1 || >=73ce9f1f2741a38f5d27393e627702ae2c46e6f2 <dca151633c0fde90935311c60e7cfc064aa56134 || >=6.6.8 <6.6.157 | 85d963499f1feeea287c0a37c3eac3fc1898eca9, 0ae90a19e6b5a8557d25d95facb7e01c9c07af38, c99ba6c234d4d537c317336376b78c088174034a, 2eda1513f573945c1e3a0090341f3d28740463b1, dca151633c0fde90935311c60e7cfc064aa56134, 6.6.157 |
| Linux/Linuxgeneric | 6.7 | Not reported |
| Linux/Linuxgeneric | >=d4b50ac06ea6e47bdd2b04e97d1090c673c80645 <0ae90a19e6b5a8557d25d95facb7e01c9c07af38 || >=d4b50ac06ea6e47bdd2b04e97d1090c673c80645 <c99ba6c234d4d537c317336376b78c088174034a || >=d4b50ac06ea6e47bdd2b04e97d1090c673c80645 <2eda1513f573945c1e3a0090341f3d28740463b1 || >=d4b50ac06ea6e47bdd2b04e97d1090c673c80645 <dca151633c0fde90935311c60e7cfc064aa56134 | 0ae90a19e6b5a8557d25d95facb7e01c9c07af38, c99ba6c234d4d537c317336376b78c088174034a, 2eda1513f573945c1e3a0090341f3d28740463b1, dca151633c0fde90935311c60e7cfc064aa56134 |
| Linux/Linuxgeneric | >=6.6.8 <6.12.109 || >=6.6.8 <6.18.50 || >=6.6.8 <7.2.4 || >=6.6.8 <7.3-rc1 | 6.12.109, 6.18.50, 7.2.4, 7.3-rc1 |
| Linux/Linuxgeneric | >=d4b50ac06ea6e47bdd2b04e97d1090c673c80645 <85d963499f1feeea287c0a37c3eac3fc1898eca9 || >=d4b50ac06ea6e47bdd2b04e97d1090c673c80645 <0ae90a19e6b5a8557d25d95facb7e01c9c07af38 || >=d4b50ac06ea6e47bdd2b04e97d1090c673c80645 <c99ba6c234d4d537c317336376b78c088174034a || >=d4b50ac06ea6e47bdd2b04e97d1090c673c80645 <2eda1513f573945c1e3a0090341f3d28740463b1 || >=d4b50ac06ea6e47bdd2b04e97d1090c673c80645 <dca151633c0fde90935311c60e7cfc064aa56134 | 85d963499f1feeea287c0a37c3eac3fc1898eca9, 0ae90a19e6b5a8557d25d95facb7e01c9c07af38, c99ba6c234d4d537c317336376b78c088174034a, 2eda1513f573945c1e3a0090341f3d28740463b1, dca151633c0fde90935311c60e7cfc064aa56134 |
| Linux/Linuxgeneric | >=6.6.8 <6.6.157 || >=6.6.8 <6.12.109 || >=6.6.8 <6.18.50 || >=6.6.8 <7.2.4 || >=6.6.8 <7.3-rc1 | 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3-rc1 |
| Linux/Linuxgeneric | >=6.6.8 <6.6.157 || >=6.6.8 <6.12.109 || >=6.6.8 <6.18.50 || >=6.6.8 <7.2.4 || >=6.6.8 <7.3 | 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hid_hw_stop Quiesce device IO at the start of the devm cleanup callback mcp2221_hid_unregister() so that incoming HID reports cannot race with hardware teardown during probe failure or device removal, addressing a potential use-after-free. Guard the call to hid_device_io_stop() with io_started. On normal removal hid_device_remove() has already cleared io_started before the devres group is released, so an unconditional call would otherwise hit the !io_started path and emit a spurious "io already stopped" warning on every removal. The guard preserves the probe-failure balancing, where io_started is still set after hid_device_io_start(), while staying silent on the normal removal path.
Quoted source text, attributed separately from HOL analysis.