{"id":"CVE-2026-80771","title":"HID: nintendo: register input device after capabilities are set","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: nintendo: register input device after capabilities are set\n\ninput_register_device() exposes the device to userspace immediately.\nIn joycon_input_create() it was ca…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < 3288bec1a21d582b504344380139cdc0e88ebe4d","Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < 268679f501386ad46405d42c2bcf89384cb5e256","Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < a9fc7547f911ada09da33c5e204e5acda38e765a","Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < 27dc4b8eadac73b3c3cc526c8547d8b4ae8528be","Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < d723bc1fe2e72b9252234e94c11af644ec477bf7","Linux 5.16"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:43:27.721Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80771","references":[{"url":"https://git.kernel.org/stable/c/3288bec1a21d582b504344380139cdc0e88ebe4d"},{"url":"https://git.kernel.org/stable/c/268679f501386ad46405d42c2bcf89384cb5e256"},{"url":"https://git.kernel.org/stable/c/a9fc7547f911ada09da33c5e204e5acda38e765a"},{"url":"https://git.kernel.org/stable/c/27dc4b8eadac73b3c3cc526c8547d8b4ae8528be"},{"url":"https://git.kernel.org/stable/c/d723bc1fe2e72b9252234e94c11af644ec477bf7"}],"tags":["cve.org"],"epss":0.00209,"epssPercentile":0.10319,"ingestedAt":"2026-10-19T10:20:54.953Z","slug":"CVE-2026-80771","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: nintendo: register input device after capabilities are set\n\ninput_register_device() exposes the device to userspace immediately.\nIn joycon_input_create() it was called before joycon_config_rumble()\nconfigures the FF_RUMBLE capability and the memless force-feedback\ndevice, so a concurrent EVIOCSFF could dereference a NULL dev->ff.\n\nRegistering early also means the initial udev event lacks button and\naxis information, which can make input managers ignore the device.\n\nMove input_register_device() to the end of joycon_input_create(), after\nall capabilities, the IMU input device and the force-feedback callbacks\nhave been configured.\n\n## Affected\n\n- `Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < 3288bec1a21d582b504344380139cdc0e88ebe4d`\n- `Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < 268679f501386ad46405d42c2bcf89384cb5e256`\n- `Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < a9fc7547f911ada09da33c5e204e5acda38e765a`\n- `Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < 27dc4b8eadac73b3c3cc526c8547d8b4ae8528be`\n- `Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < d723bc1fe2e72b9252234e94c11af644ec477bf7`\n- `Linux 5.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}