HIGH Introduced in 4.10
hid-sony DeviceList UAF
CVE-2026-90041
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list on probe failure sony_input_configured() adds some controllers to sony_device_list before HID core registers their input devices. input_register_device() can fail after the callback returns successfully. sony_probe() then observes that HID_CLAIMED_INPUT is clear and unwinds, but only stops the HID hardware. The devres-managed sony_sc is freed while its list node remains linked, so the next matching controller traverses freed memory. Initialize the list node and device ID to inactive states. Make list removal idempotent and run the driver-private cleanup on every probe failure path. This also makes a second cleanup safe when sony_input_configured() already unwound a partial initialization before sony_probe() handles the missing input claim. Found by 0sec (https://0sec.ai) using automated source analysis; verified against the HID input registration and probe unwind paths.
02KernelScan AI Analysis
Risk summary
A use-after-free in the Sony HID controller driver allows a dangling list entry to persist after a failed device probe, causing the next controller connection to traverse freed memory. An attacker with physical access to a USB port or Bluetooth proximity can trigger this by connecting a Sony controller whose input registration fails, then connecting a second matching controller. The bug can lead to kernel memory corruption, information disclosure, or a system crash.
Vulnerability analysis
The Sony HID driver adds a controller to a global device list during probe, before the kernel finishes registering its input device. If that registration fails, the probe cleanup stops the hardware but never removes the controller from the list. The controller's private data is then freed automatically, leaving a dangling list node that the next matching controller connection will dereference as it walks the list. The fix initializes the list node and device identifier to safe inactive states at allocation time, makes list removal idempotent so it can be called safely on every failure path, and consolidates the driver's private teardown into a single cleanup helper that is now invoked on all probe failure routes. The vulnerability is reachable by anyone who can physically connect a Sony controller via USB or pair one over Bluetooth; no kernel or system privileges are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.10 | 6.12.111 | b84544ef00a2 |
| 6.18 | 4.10 | 6.18.51 | 3b4709e48649 |
| 6.6 | 4.10 | 6.6.160 | 7ee50d42a6d5 |
| 7.2 | 4.10 | 7.2.5 | d044d796e2a3 |
| mainline | 4.10 | 7.3 | 7c65699a3a31 |
| cip/6.12 | 4.10 | 6.12.111-cip32 | b84544ef00a2 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |