{"id":"CVE-2026-89624","revision":"5c47231e0b934a008245a6438bf514bf","records":[{"revision":"5c47231e0b934a008245a6438bf514bf","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89624","aliases":[],"title":"HID: universal-pidff: stop the device when force-feedback init fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: universal-pidff: stop the device when force-feedback init fails\n\nuniversal_pidff_probe() starts the device with hid_hw_start() and then, if\nforce-feedback initialisation fails, returns the error through a label that\nonly does \"return error\". The device is left started.\n\nThe HID core does not unwind on the driver's behalf. __hid_device_probe()\nreleases the devres group, closes the report and clears hdev->driver:\n\n\tif (ret) {\n\t\tdevres_release_group(&hdev->dev, hdev->devres_group_id);\n\t\thid_close_report(hdev);\n\t\thdev->driver = NULL;\n\t}\n\nThe hidraw character device that hid_hw_start() registered through\nhid_connect() is allocated with kzalloc() and added with cdev_device_add(),\nso it is not devres-managed and survives that. With hdev->driver NULL,\nhid_device_remove() skips hid_hw_stop() as well, because it only unwinds\nwhile a driver is still attached. The registration therefore outlives the\ndevice on both paths.\n\nOpening the surviving /dev/hidrawX writes into freed memory. KASAN reports\na use-after-free write from hidraw_open() -> hid_hw_open() -> the\ntransport's open callback, which takes a spinlock inside the freed object.\nA descriptor that carries a PID usage page and no input reports is enough:\nhidraw claims the device so hid_hw_start() succeeds, while hid->inputs\nstays empty so force-feedback init fails. The other failure returns in\nhid_pidff_init_with_quirks() - no output reports, an allocation failure,\npidff_init_fields(), pidff_check_autocenter(), an unusable effect count,\ninput_ff_create() - all reach the same label.\n\nStop the device on that path. hid-dr.c and hid-emsff.c, which start the\ndevice with the same HID_CONNECT_DEFAULT & ~HID_CONNECT_FF mask, already do\nthis. The two earlier gotos must keep returning without hid_hw_stop(),\nsince neither has a started device, so give the path that fails after the\nstart its own label.\n\nDiscovered by XBOW, triaged by Baul Lee ","state":0,"publishedAt":"2026-09-11T19:45:21.438+00:00","modifiedAt":"2026-10-21T12:48:01.115+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/hid/hid-universal-pidff.c\"\n ],\n \"versions\": [\n {\n \"version\": \"c1fde337b317f0a226de92803288741c30799eb0\",\n \"lessThan\": \"66358f5789c9a7e28809985a83c01e6ad933849e\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"f45f26a6b3e7260c129c7c6bb0ace63aeb7b3868\",\n \"lessThan\": \"519fa26695b02870022fcdc651efb3d379abe54e\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"f06bf8d94fffbb544b1cb5402c92e0a075f0d420\",\n \"lessThan\": \"01d9874e84d3ab78fd212ad822412eb3af84497f\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"f06bf8d94fffbb544b1cb5402c92e0a075f0d420\",\n \"lessThan\": \"c457bb516b61edeab940235a011928e26925381e\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"f06bf8d94fffbb544b1cb5402c92e0a075f0d420\",\n \"lessThan\": \"ce08c5555cabcd444d8b77fa69a7cb68bb05f611\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"af9f2471dfe5a48384f5b7f021a673fbc741465e\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b797352954eee6dc084cfaed0659dea60adfb484\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"6.6.88\",\n \"lessThan\": \"6.6.160\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.24\",\n \"lessThan\": \"6.12.111\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.13.12\",\n \"lessThan\": \"6.14\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.14.3\",\n \"lessThan\": \"6.15\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/hid/hid-universal-pidff.c\"\n ],\n \"versions\": [\n {\n \"version\": \"6.15\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"6.15\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.160\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.111\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.50\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2.4\",\n \"lessThanOrEqual\": \"7.2.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.3\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/66358f5789c9a7e28809985a83c01e6ad933849e","https://git.kernel.org/stable/c/519fa26695b02870022fcdc651efb3d379abe54e","https://git.kernel.org/stable/c/01d9874e84d3ab78fd212ad822412eb3af84497f","https://git.kernel.org/stable/c/c457bb516b61edeab940235a011928e26925381e","https://git.kernel.org/stable/c/ce08c5555cabcd444d8b77fa69a7cb68bb05f611"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89624","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89624","identifiers":["CVE-2026-89624"]},"retained":false,"historicalAffected":[]}],"coverage":[]}