CVE-2026-93189: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-c7vq-j3hm-m6qq
Share
CVSS 8.8
Published
Advisory Summary

CVE-2026-93189 is a HIGH (CVSS 8.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-93189 at a Glance

CVE Identifier CVE-2026-93189
GHSA Identifier GHSA-c7vq-j3hm-m6qq
Severity HIGH
CVSS v3.1 Base Score 8.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 8.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Adjacent (AV:A)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-93189

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-93189, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: HID: core: quiesce input in hid_hw_stop() to prevent use-after-free A driver's probe calls hid_device_io_start() to enable input delivery, then fails at a later initialization step and unwinds via hid_hw_stop(). The unwind frees struct hidraw via hidraw_disconnect() while in-flight HID reports may still be running on another CPU, dereferencing the freed object through hidraw_report_event(). syzbot reports the resulting use-after-free for the corsair-psu HID driver. Edward Adam Davis posted a per-driver fix for corsair-psu that adds an explicit hid_device_io_stop() before hid_hw_stop() in the probe error path ("hwmon: prevent packets from going to driver for probe", 2026-04-28). Auditing the tree shows 15 drivers call hid_device_io_start(); 7 also call hid_device_io_stop() and 8 do not: drivers calling hid_device_io_start() without a matching hid_device_io_stop() before hid_hw_stop(): drivers/hwmon/corsair-psu.c (fix posted by Edward) drivers/hwmon/corsair-cpro.c drivers/hwmon/nzxt-kraken3.c drivers/hwmon/nzxt-smart2.c drivers/hwmon/gigabyte_waterforce.c drivers/hid/hid-logitech-dj.c drivers/hid/hid-nintendo.c drivers/hid/hid-mcp2221.c Roughly half of all callers of the API are exposed. Centralize the quiesce in hid_hw_stop() so callers do not have to remember the matching stop: if a driver has left hdev->io_started true on entry, call hid_device_io_stop() before hid_disconnect(). For the 7 drivers that already call hid_device_io_stop() correctly, hdev->io_started is false on entry, the guard short-circuits, and behavior is unchanged. No Fixes: tag because the affected drivers gained their hid_device_io_start() calls independently over years; the bug is a class-wide API misuse rather than a regression from one commit.

References

NVD — CVE-2026-93189 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93189
git.kernel.org/stable/c/02246d8b46... WEB
https://git.kernel.org/stable/c/02246d8b462fd9bd90bc7ae7d6cab1acf69bcb87
git.kernel.org/stable/c/0744cb9520... WEB
https://git.kernel.org/stable/c/0744cb9520aade37e78f69134f3111086158f1d2
git.kernel.org/stable/c/0fecd89f97... WEB
https://git.kernel.org/stable/c/0fecd89f979a8653b9a5b0816570329b7a94a081
git.kernel.org/stable/c/544ebb25bd... WEB
https://git.kernel.org/stable/c/544ebb25bd58f67e821573412ab7a982b9e02211
git.kernel.org/stable/c/6787f1828f... WEB
https://git.kernel.org/stable/c/6787f1828f5616f17250e108c0031fb96fd2cfe6
git.kernel.org/stable/c/92cca302a4... WEB
https://git.kernel.org/stable/c/92cca302a4eaf65d1b38b3fb600b4ee5eb856a51
git.kernel.org/stable/c/a4bc415046... WEB
https://git.kernel.org/stable/c/a4bc41504690b7d7064931909874f5b98cd148b6
git.kernel.org/stable/c/c876c437d1... WEB
https://git.kernel.org/stable/c/c876c437d188911685d8bed645416f2e86bd0354

Frequently Asked Questions

What is CVE-2026-93189?
CVE-2026-93189 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-93189?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-93189?
CVE-2026-93189 has a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-93189?
CVE-2026-93189 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-93189?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c7vq-j3hm-m6qq",
  "modified" : "2026-09-18T18:31:34Z",
  "published" : "2026-09-17T18:32:13Z",
  "aliases" : [ "CVE-2026-93189" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: quiesce input in hid_hw_stop() to prevent use-after-free\n\nA driver's probe calls hid_device_io_start() to enable input delivery,\nthen fails at a later initialization step and unwinds via hid_hw_stop().\nThe unwind frees struct hidraw via hidraw_disconnect() while in-flight\nHID reports may still be running on another CPU, dereferencing the\nfreed object through hidraw_report_event(). syzbot reports the\nresulting use-after-free for the corsair-psu HID driver.\n\nEdward Adam Davis posted a per-driver fix for corsair-psu that adds\nan explicit hid_device_io_stop() before hid_hw_stop() in the probe\nerror path (\"hwmon: prevent packets from going to driver for probe\",\n2026-04-28). Auditing the tree shows 15 drivers call\nhid_device_io_start(); 7 also call hid_device_io_stop() and 8 do not:\n\n  drivers calling hid_device_io_start() without a matching\n  hid_device_io_stop() before hid_hw_stop():\n    drivers/hwmon/corsair-psu.c       (fix posted by Edward)\n    drivers/hwmon/corsair-cpro.c\n    drivers/hwmon/nzxt-kraken3.c\n    drivers/hwmon/nzxt-smart2.c\n    drivers/hwmon/gigabyte_waterforce.c\n    drivers/hid/hid-logitech-dj.c\n    drivers/hid/hid-nintendo.c\n    drivers/hid/hid-mcp2221.c\n\nRoughly half of all callers of the API are exposed. Centralize the\nquiesce in hid_hw_stop() so callers do not have to remember the\nmatching stop: if a driver has left hdev->io_started true on entry,\ncall hid_device_io_stop() before hid_disconnect().\n\nFor the 7 drivers that already call hid_device_io_stop() correctly,\nhdev->io_started is false on entry, the guard short-circuits, and\nbehavior is unchanged.\n\nNo Fixes: tag because the affected drivers gained their\nhid_device_io_start() calls independently over years; the bug is a\nclass-wide API misuse rather than a regression from one commit.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-93189"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/02246d8b462fd9bd90bc7ae7d6cab1acf69bcb87"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0744cb9520aade37e78f69134f3111086158f1d2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0fecd89f979a8653b9a5b0816570329b7a94a081"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/544ebb25bd58f67e821573412ab7a982b9e02211"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6787f1828f5616f17250e108c0031fb96fd2cfe6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/92cca302a4eaf65d1b38b3fb600b4ee5eb856a51"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a4bc41504690b7d7064931909874f5b98cd148b6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c876c437d188911685d8bed645416f2e86bd0354"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:18:15Z"
  }
}