CVE-2026-89626 (CVSS 8.8)

Description

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hid_sensor_custom_add_attributes() creates one sysfs group for each custom sensor field. If sysfs_create_group() fails after some groups have already been created, the function returns the error without removing the previously created groups. Add a local unwind path to remove the groups that were already created. With enable_sensor exposed only after the field attributes are ready, this path can free sensor_inst->fields without leaving enable_sensor able to access pointers into that array.

Is your site exposed to CVE-2026-89626?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0035

Probability of exploitation

0.28%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/10b05fafff932e325896d59dde40938954ab4577 https://git.kernel.org/stable/c/2409779f3096fcef41bcf57b5f4887d0fa0dc8dd https://git.kernel.org/stable/c/3789d0802ddb4b3be04062caf4bfadd23496e9a7 https://git.kernel.org/stable/c/416194933af63bd58d03b7605b1ebc1711186838 https://git.kernel.org/stable/c/79154fad98ee843e5363940841e2d831503c190a https://git.kernel.org/stable/c/d0e15091e88d18e30b67daf85b88f6528bb9bf41 https://git.kernel.org/stable/c/d96f8958d4469ac02d9c563686cdd968005b944d https://git.kernel.org/stable/c/f3f37b937a6ea2a00fb5e6189e74f855caa43eb5

Frequently Asked Questions

What is CVE-2026-89626? +

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hid_sensor_custom_add_attributes() creates one sysfs group for each custom sensor field. If sysfs_create_group() fails after some groups have already been created, the function returns the error without removing the previously created groups. Add a local unwind path to remove the groups that were already created. With enable_sensor exposed only after the field attributes are ready, this path can free sensor_inst->fields without leaving enable_sensor able to access pointers into that array. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2026-89626? +

CVE-2026-89626 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0035, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-89626? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-89626