HIGH
hid G920Probe UAF
CVE-2026-43049
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Presently, if the force feedback initialisation fails when probing the Logitech G920 Driving Force Racing Wheel for Xbox One, an error number will be returned and propagated before the userspace infrastructure (sysfs and /dev/input) has been torn down. If userspace ignores the errors and continues to use its references to these dangling entities, a UAF will promptly follow. We have 2 options; continue to return the error, but ensure that all of the infrastructure is torn down accordingly or continue to treat this condition as a warning by emitting the message but returning success. It is thought that the original author's intention was to emit the warning but keep the device functional, less the force feedback feature, so let's go with that.
02KernelScan AI Analysis
Risk summary
Systems with accessible USB ports are at risk when a Logitech G920 racing wheel is connected and its force feedback initialization fails. The vulnerability can cause kernel crashes, limited memory corruption, and potential kernel heap information disclosure when userspace accesses dangling sysfs or /dev/input references after a failed probe.
Vulnerability analysis
The root cause is improper error handling in the HID logitech-hidpp driver probe function. When force feedback initialization fails for the G920 racing wheel, the function returns an error after userspace infrastructure (sysfs and /dev/input) has already been established, creating dangling references. If userspace ignores the probe failure and continues to access these entities, a use-after-free occurs. The fix changes the error path to treat FF initialization failure as non-fatal, logging a warning but returning success so the device remains functional without force feedback, preventing the UAF condition.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.4 | 5.4 | 772f99cc8d6e |
| 6.12 | 6.12.81 | b846fb0a73e9 |
| 6.18 | 6.18.22 | 9a793ac19eb8 |
| 6.19 | 6.19.12 | f7a4c78bfeb3 |
| mainline | 7.0 | — |