Junglewise Threat Intelligence

CVE-2026-43152: Linux Kernel NULL pointer dereference in hid-pl driver

CVE-2026-43152 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's PantherLord USB/PS2 adapter driver could allow a local user to crash the system. The issue occurs when the driver fails to properly handle errors during device setup, leading to a system crash (NULL pointer dereference) when force feedback features are used. This primarily impacts system availability.

Technical details

A vulnerability exists in the PantherLord USB/PS2 2in1 Adapter HID driver (hid-pl.c) within the Linux kernel. The root cause is a failure to check and report errors during the initialization phase in the pl_probe function. Specifically, if plff_init fails, the driver continues operation instead of halting. This leads to a NULL pointer dereference the first time a force feedback (FF) event is triggered. An attacker with local access could exploit this to cause a kernel oops and system crash. Patches have been released across multiple stable kernel branches to properly handle probe errors and stop the hardware if initialization fails.

Affected products

  • Linux Linux Kernel 2.6.21 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-05-06: disclosed
  • 2026-05-06: advisory
  • 2026-01-10: patched: Initial patch committed to mainline kernel.

References

Related threats