HIGH Introduced in 3.19
hid ConnectEvent UAF
CVE-2026-93826
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidpp_connect_event() If input_register_device() fails, we call input_free_device(), but keep stale pointer to the old device in hidpp->input, which could potentially lead to UAF. Fix that by resetting it to NULL before returning from hidpp_connect_event().
02KernelScan AI Analysis
Risk summary
A use-after-free in the Logitech HID++ driver can be triggered by connecting a malicious HID device over USB (physical access) or potentially Bluetooth (proximity). No system privileges are required. Successful exploitation could lead to kernel memory corruption, enabling denial of service or potential code execution.
Vulnerability analysis
The Logitech HID++ device driver can leave a dangling pointer to a freed input device when device registration fails during the connection sequence. After the input device is freed due to a registration error, the driver continues to store the old pointer, and any later operation that uses it will access already-freed kernel memory. The fix clears the stored pointer immediately after the failed registration, so subsequent code paths will not dereference freed memory. The vulnerability is reachable by connecting a crafted Logitech HID++ device, typically over USB which requires physical access to a port, or potentially over Bluetooth which requires proximity, without needing any account or special privileges on the target system.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 3.19 | 6.1.189 | e03fd646adad |
| 6.6 | 3.19 | 6.6.158 | 5d7637f4d050 |
| 6.12 | 3.19 | 6.12.111 | 3b8b2e58b078 |
| 6.18 | 3.19 | 6.18.53 | 3303398cc2aa |
| mainline | 3.19 | 7.2 | 6df6b1f2c496 |
| cip/6.12 | 3.19 | 6.12.111-cip32 | 3b8b2e58b078 |