Executive brief
The Linux kernel's HID driver for Nintendo gaming controllers had a race condition in device initialization. The input device was exposed to userspace before force-feedback (rumble) capabilities were properly configured, allowing a user application to trigger a null pointer dereference and potentially crash the system or cause unexpected behavior.
Technical details
This vulnerability is a use-after-free / null pointer dereference in the joycon_input_create() function of drivers/hid/hid-nintendo.c. The root cause is a race condition: input_register_device() was called before joycon_config_rumble() configured the force-feedback device, allowing a concurrent EVIOCSFF ioctl to dereference a NULL dev->ff pointer. The vulnerable component is the Nintendo Switch controller HID driver. The attack vector requires local access and user-level privileges to issue input control ioctls, but no special capability or authentication is required. A fix is available in upstream Linux kernel patches (commit d723bc1fe2e72b9252234e94c11af644ec477bf7 and later), which moves input_register_device() to the end of joycon_input_create() after all capabilities and callbacks are configured.
Affected products
- Linux Linux kernel Various versions affected; patched in stable trees from 2026-08-27 onwards
Timeline
- 2026-09-04: disclosed: CVE-2026-80771 published on NVD
- 2026-07-30: patched: Upstream fix commit d723bc1fe2e72b9252234e94c11af644ec477bf7 authored
- 2026-08-27: patched: Patches committed to stable kernel trees