Executive brief
The Linux kernel's HID (Human Interface Device) force-feedback driver contains an out-of-bounds memory write vulnerability when initializing force-feedback for certain HID devices. An attacker can trigger this by connecting a specially crafted USB device without requiring any user interaction or software execution, potentially causing a kernel crash or memory corruption.
Technical details
The vulnerability is a heap out-of-bounds write in the hid_pidff_init_with_quirks() function, which attempts to derive an input device pointer from an empty linked list without validation. The root cause is an unguarded list_entry() call that, on an empty list, yields a type-confused pointer into struct hid_device rather than a valid struct hid_input. Subsequent set_bit() calls for force-feedback capabilities and input_ff_create() write 8 bytes and heap pointers past the end of the allocated object. The attack is reachable via universal_pidff_probe() when a malicious report descriptor contains only a PID (force-feedback) usage page, leaving hid->inputs empty while bypassing the normal HID_CLAIMED_INPUT gate. The fix checks for an empty list and returns -ENODEV before the vulnerable code executes. Attack vector is local/physical (USB device hotplug); no authentication or user interaction required.
Affected products
- Linux Linux kernel Affected versions prior to the fix for CVE-2026-80780
Timeline
- 2026-09-04: disclosed