AZL-99624
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99624.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-99624
- Upstream
- Published
- 2026-09-04T16:18:02Z
- Modified
- 2026-09-05T14:17:04.607838566Z
- Summary
- CVE-2026-80771 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
HID: nintendo: register input device after capabilities are set
inputregisterdevice() exposes the device to userspace immediately. In joyconinputcreate() it was called before joyconconfigrumble() configures the FF_RUMBLE capability and the memless force-feedback device, so a concurrent EVIOCSFF could dereference a NULL dev->ff.
Registering early also means the initial udev event lacks button and axis information, which can make input managers ignore the device.
Move inputregisterdevice() to the end of joyconinputcreate(), after all capabilities, the IMU input device and the force-feedback callbacks have been configured.
- References