KernelScan.io

HIGH

hid G920Probe UAF

CVE-2026-43049

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI5.7MEDIUM

01

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Presently, if the force feedback initialisation fails when probing the Logitech G920 Driving Force Racing Wheel for Xbox One, an error number will be returned and propagated before the userspace infrastructure (sysfs and /dev/input) has been torn down. If userspace ignores the errors and continues to use its references to these dangling entities, a UAF will promptly follow. We have 2 options; continue to return the error, but ensure that all of the infrastructure is torn down accordingly or continue to treat this condition as a warning by emitting the message but returning success. It is thought that the original author's intention was to emit the warning but keep the device functional, less the force feedback feature, so let's go with that.

02

Engine v0.2.0

Risk summary

Systems with accessible USB ports are at risk when a Logitech G920 racing wheel is connected and its force feedback initialization fails. The vulnerability can cause kernel crashes, limited memory corruption, and potential kernel heap information disclosure when userspace accesses dangling sysfs or /dev/input references after a failed probe.

Affecteddrivers/hid/hid-logitech-hidpp.c (HID subsystem)

Vulnerability analysis

The root cause is improper error handling in the HID logitech-hidpp driver probe function. When force feedback initialization fails for the G920 racing wheel, the function returns an error after userspace infrastructure (sysfs and /dev/input) has already been established, creating dangling references. If userspace ignores the probe failure and continues to access these entities, a use-after-free occurs. The fix changes the error path to treat FF initialization failure as non-fatal, logging a warning but returning success so the device remains functional without force feedback, preventing the UAF condition.

03

BranchFixed inPatch commit
5.45.4772f99cc8d6e
6.126.12.81b846fb0a73e9
6.186.18.229a793ac19eb8
6.196.19.12f7a4c78bfeb3
mainline7.0