CVE-2026-80771HID: nintendo: register input device after capabilities are set
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input_register_device() exposes the device to userspace immediately. In joycon_input_create() it was called before joycon_config_rumble() configures the FF_RUMBLE capability and the memless force-feedback device, so a concurrent EVIOCSFF could dereference a NULL dev->ff. Registering early also means the initial udev event lacks button and axis information, which can make input managers ignore the device. Move input_register_device() to the end of joycon_input_create(), after all capabilities, the IMU input device and the force-feedback callbacks have been configured.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2af16c1f846bd60240745bbd3afa13d5f040c61a before 3288bec1a21d582b504344380139cdc0e88ebe4d; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before 268679f501386ad46405d42c2bcf89384cb5e256; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before a9fc7547f911ada09da33c5e204e5acda38e765a; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before 27dc4b8eadac73b3c3cc526c8547d8b4ae8528be; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before d723bc1fe2e72b9252234e94c11af644ec477bf7 | CNA record |
References
- https://git.kernel.org/stable/c/3288bec1a21d582b504344380139cdc0e88ebe4d
- https://git.kernel.org/stable/c/268679f501386ad46405d42c2bcf89384cb5e256
- https://git.kernel.org/stable/c/a9fc7547f911ada09da33c5e204e5acda38e765a
- https://git.kernel.org/stable/c/27dc4b8eadac73b3c3cc526c8547d8b4ae8528be
- https://git.kernel.org/stable/c/d723bc1fe2e72b9252234e94c11af644ec477bf7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.