CVE-2026-90330HID: logitech-hidpp: Fix FF device cleanup on init failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix FF device cleanup on init failure hidpp_ff_init() creates the input force-feedback device with input_ff_create(), then allocates the HID++ FF private data, effect ID array, and workqueue. If any of those allocations fail after input_ff_create() succeeds, the function returns an error without destroying the FF device. Add an unwind path that frees the private allocations made by hidpp_ff_init() and calls input_ff_destroy() for failures after input_ff_create() succeeds.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ff21a635dd1a9c6ca378847160897649cdbbfae4 before 2fd9c8112907c14efefe6a90d20b774737052db3; from ff21a635dd1a9c6ca378847160897649cdbbfae4 before 13378c9ac0a1bcdf49ba158e4199594aafb589cd; from ff21a635dd1a9c6ca378847160897649cdbbfae4 before dd5be4d9ce2dfc4d4a4527ef7d31d21a78e3cdac | CNA record |
References
- https://git.kernel.org/stable/c/2fd9c8112907c14efefe6a90d20b774737052db3
- https://git.kernel.org/stable/c/13378c9ac0a1bcdf49ba158e4199594aafb589cd
- https://git.kernel.org/stable/c/dd5be4d9ce2dfc4d4a4527ef7d31d21a78e3cdac
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.