Executive brief
The Linux kernel's HID driver for Sony controllers has a memory management flaw that can cause a system crash (denial of service) when a controller fails to initialize. When the device driver probe fails partway through, freed memory remains referenced by kernel data structures, allowing a subsequent device connection to access corrupted memory and crash the system.
Technical details
The vulnerability is a use-after-free in the HID sony driver's probe and device configuration routines. The sony_input_configured() function adds controllers to a global sony_device_list before input device registration. If input_register_device() fails after the callback returns, sony_probe() unwinds but only stops the HID hardware; the devres-managed sony_sc structure is freed while its list node remains linked. On the next matching controller connection, the kernel traverses the linked list and accesses freed memory. The fix initializes the list node and device ID to inactive states on probe entry, makes list removal idempotent, and ensures cleanup runs on all failure paths. No authentication or special privileges are required; the vulnerability requires only a controller connection attempt to occur after a failed probe.
Affected products
- Linux Linux kernel Multiple versions; patch available in stable branches
Timeline
- 2026-09-16: disclosed
- 2026-09-11: patched: Patch merged into stable tree