Executive brief
The Linux kernel's Nintendo Switch controller driver has a flaw in error handling during device initialization. If controller setup or LED initialization fails, the driver may stop device communication incorrectly, leaving input handling active while the driver data is being torn down. This can cause the device to access freed memory, potentially crashing the kernel or enabling local privilege escalation on affected systems.
Technical details
This is a use-after-free vulnerability in the HID (Human Interface Device) Nintendo driver's probe function (drivers/hid/hid-nintendo.c). The root cause is an incorrect error-handling path: after calling hid_device_io_start() to enable device I/O, if joycon_init() or joycon_leds_create() fails, the code jumps to err_close which calls hid_hw_stop() without first stopping device I/O via hid_device_io_stop(). Since hid_hw_stop() does not halt device I/O, hid_input_report() callbacks may continue executing and access driver data structures that are concurrently being freed, causing a use-after-free. The fix adds an err_io_stop label that calls hid_device_io_stop() before hid_hw_close(). This vulnerability affects any system with a connected Nintendo Switch controller where probe initialization fails. A patch is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Versions with HID Nintendo driver (since commit 2af16c1f846b)
Timeline
- 2026-07-30: other: Fix authored by Jiangshan Yi
- 2026-08-27: patched: Patch merged into Linux stable tree by Greg Kroah-Hartman
- 2026-09-04: disclosed: CVE-2026-80770 published