CVE-2026-90329 is a vulnerability in the Linux kernel's Human Interface Device (HID) subsystem. The function hid_device_io_start() permits input reports to execute concurrently with the probing process. If the probe subsequently fails, __hid_device_probe() releases driver resources and clears the device's driver pointer without first excluding report callbacks that may still be running. This can lead to a use-after-free condition, for example, when a report enters hidraw_report_event() while the associated hidraw object has been freed, causing access to a freed list lock. The vulnerability is mitigated by stopping input processing before performing cleanup on a failed probe, which involves reacquiring the driver_input_lock and waiting for any in-progress report callbacks to complete.

Successful exploitation can lead to use-after-free conditions, resulting in potential arbitrary code execution, denial of service, or system compromise due to corrupted memory access. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

A fix has been implemented in the Linux kernel that stops input processing before cleaning up after a failed probe, ensuring synchronization and preventing use-after-free. Users and administrators should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Since this is a kernel-level issue, updating to the patched kernel version is the recommended remediation.