HID: pidff: fix OOB write when hid->inputs is empty

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-80780
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-04 16:18:03 UTC
Updated2026-09-04 16:18:03 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid->inputs is empty hid_pidff_init_with_quirks() derives its input_dev from list_entry(hid->inputs.next, struct hid_input, list) without first checking that hid->inputs is non-empty. The list member of struct hid_input is at offset 0, so on an empty list list_entry() yields &hid->inputs itself and the following hidinput->input load reads an unrelated member of struct hid_device. dev is then a type-confused pointer, and force-feedback init writes through it: each set_bit(FF_*, dev->ffbit) stores 8 bytes at dev + 192, past the end of the object dev actually aliases, and input_ff_create() adds further writes of a heap pointer and two function pointers. Until hid-universal-pidff the only caller was hid_pidff_init() from usbhid, which runs under HID_CLAIMED_INPUT and therefore always has at least one hid_input. universal_pidff_probe() starts the device with HID_CONNECT_DEFAULT & ~HID_CONNECT_FF and then calls hid_pidff_init_with_quirks() directly whenever the descriptor carries a PID usage page, bypassing that gate. A report descriptor whose only application collection is on HID_UP_PID leaves hid->inputs empty while hid_connect() still succeeds through the hidraw claim, so probe reaches the unguarded list_entry(). The write happens in the USB probe path, on the hotplug workqueue, so plugging in a malicious device is enough to trigger it; no attacker software and no logged-in user are required. KASAN reports an 8-byte out-of-bounds write in hid_pidff_init_with_quirks() reached from universal_pidff_probe(). Check for an empty list before deriving dev and return -ENODEV, as the other HID force-feedback drivers already do. universal_pidff_probe() propagates the error and unwinds. Discovered by XBOW, triaged by Baul Lee <[email protected]>

Risk And Classification

EPSS: 0.001810000 probability, percentile 0.077700000 (date 2026-09-07)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c1fde337b317f0a226de92803288741c30799eb0 2e0471bf3ab2a6b7eedcc3b8a2a17286b6a9ae1a git Not specified
CNA Linux Linux affected f45f26a6b3e7260c129c7c6bb0ace63aeb7b3868 ad9330f7e74a97842815a291a0d7389ed2f34504 git Not specified
CNA Linux Linux affected f06bf8d94fffbb544b1cb5402c92e0a075f0d420 4529c03c3da8f91392cd630453452f569973f4cd git Not specified
CNA Linux Linux affected f06bf8d94fffbb544b1cb5402c92e0a075f0d420 d416eeb7d016d82af67c149d884bc6a9323c4ac7 git Not specified
CNA Linux Linux affected f06bf8d94fffbb544b1cb5402c92e0a075f0d420 86b63adfa5e132beac4be72668fdf9128fe51d2e git Not specified
CNA Linux Linux affected f06bf8d94fffbb544b1cb5402c92e0a075f0d420 67bb1074e3d2d12fa059a9cc707e89398a4e4704 git Not specified
CNA Linux Linux affected af9f2471dfe5a48384f5b7f021a673fbc741465e git Not specified
CNA Linux Linux affected b797352954eee6dc084cfaed0659dea60adfb484 git Not specified
CNA Linux Linux affected 6.6.88 6.6.156 semver Not specified
CNA Linux Linux affected 6.12.24 6.12.108 semver Not specified
CNA Linux Linux affected 6.13.12 6.14 semver Not specified
CNA Linux Linux affected 6.14.3 6.15 semver Not specified
CNA Linux Linux affected 6.15 Not specified
CNA Linux Linux unaffected 6.15 semver Not specified
CNA Linux Linux unaffected 6.6.156 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.108 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.47 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.11 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2.1 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/ad9330f7e74a97842815a291a0d7389ed2f34504 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d416eeb7d016d82af67c149d884bc6a9323c4ac7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/86b63adfa5e132beac4be72668fdf9128fe51d2e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4529c03c3da8f91392cd630453452f569973f4cd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2e0471bf3ab2a6b7eedcc3b8a2a17286b6a9ae1a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/67bb1074e3d2d12fa059a9cc707e89398a4e4704 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report