CVE-2026-53037
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix deadlock in hid_post_reset() You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hid_pre_reset() and hid_post_reset() are in the block IO error handling. Hence no memory allocation used in them may do block IO because the IO can deadlock on the mutex held while resetting a device and calling the interface drivers. Use GFP_NOIO for all allocations in them.
Affected versions
Linux kernel versions
3.5
and later are affected. Fixed in
5.10.258,
5.15.209,
6.1.175,
6.6.141,
6.12.91,
6.18.33,
7.0.10,
7.1
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-53037?
CVE-2026-53037 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.5 onward and has been patched in 5.10.258, 5.15.209, 6.1.175 and others. CVE-2026-53037 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-53037?
Yes — CVE-2026-53037 has been patched. Fixed versions include 5.10.258, 5.15.209, 6.1.175 and others. If you are running Linux kernel 3.5 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-53037 actively exploited?
No — CVE-2026-53037 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.