Executive brief
A vulnerability was identified in the Linux kernel's PlayStation controller driver. The software fails to properly check for errors when setting up vibration (force feedback) features. This could lead to unpredictable system behavior or a system crash when a game or application attempts to trigger controller vibration.
Technical details
The vulnerability exists in the ps_gamepad_create() function within drivers/hid/hid-playstation.c. The code calls input_ff_create_memless() to initialize force feedback (FF) effects but does not verify the return value. If this function fails (e.g., due to memory exhaustion), the driver continues as if initialization succeeded. Subsequent attempts to trigger FF effects on an uninitialized or null-referenced structure can lead to a kernel null pointer dereference or other undefined behavior. This is a local vulnerability requiring the ability to interact with HID devices or trigger force feedback events. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel Fixed in versions 33acf9a, 35301ca, 45b01d8, 496a345, 987dee1, d955aeb, e680764
Timeline
- 2025-11-17: other: Initial patch authored
- 2026-05-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/33acf9a4d6eb1f6d01691faca96ad6b2ab0fcfc0
- https://git.kernel.org/stable/c/35301ca2a83d17aac2f3e8e35c696f0da2a13111
- https://git.kernel.org/stable/c/45b01d85265bc1ccdd69e0a7887db4b905a778f4
- https://git.kernel.org/stable/c/496a345cc047a2c2d9d5a76956e1182525578bd5
- https://git.kernel.org/stable/c/987dee1486e975e2baa6a5d062cfdf18bbe901c8
- https://git.kernel.org/stable/c/d955aeb26e1210a018492b3b32cbdfaf017aaa25
- https://git.kernel.org/stable/c/e6807641ac94e832988655a1c0e60ccc806b76dc