{"id":"CVE-2026-89624","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: universal-pidff: stop the device when force-feedback init fails\n\nuniversal_pidff_probe() starts the device with hid_hw_start() and then, if\nforce-feedback initiali…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: universal-pidff: stop the device when force-feedback init fails\n\nuniversal_pidff_probe() starts the device with hid_hw_start() and then, if\nforce-feedback initiali…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-825"],"vendor":"Linux","product":"Linux","affected":["Linux >= f45f26a6b3e7260c129c7c6bb0ace63aeb7b3868 < 519fa26695b02870022fcdc651efb3d379abe54e","Linux >= f06bf8d94fffbb544b1cb5402c92e0a075f0d420 < 01d9874e84d3ab78fd212ad822412eb3af84497f","Linux >= f06bf8d94fffbb544b1cb5402c92e0a075f0d420 < c457bb516b61edeab940235a011928e26925381e","Linux >= f06bf8d94fffbb544b1cb5402c92e0a075f0d420 < ce08c5555cabcd444d8b77fa69a7cb68bb05f611","Linux c1fde337b317f0a226de92803288741c30799eb0","Linux af9f2471dfe5a48384f5b7f021a673fbc741465e","Linux b797352954eee6dc084cfaed0659dea60adfb484","Linux >= 6.12.24 < 6.12.111","Linux >= 6.6.88 < 6.7","Linux >= 6.13.12 < 6.14","Linux >= 6.14.3 < 6.15","Linux 6.15"],"published":"2026-09-11","updated":"2026-09-21","sourceUpdated":"2026-09-21T14:17:24.103","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89624","references":[{"url":"https://git.kernel.org/stable/c/01d9874e84d3ab78fd212ad822412eb3af84497f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/519fa26695b02870022fcdc651efb3d379abe54e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c457bb516b61edeab940235a011928e26925381e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce08c5555cabcd444d8b77fa69a7cb68bb05f611","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89624.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89624"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532040"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89624"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89624"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89624.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00168,"epssPercentile":0.06563,"scores":{"nvd":7.8,"cna":7.8,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.474Z","slug":"CVE-2026-89624","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: universal-pidff: stop the device when force-feedback init fails\n\nuniversal_pidff_probe() starts the device with hid_hw_start() and then, if\nforce-feedback initialisation fails, returns the error through a label that\nonly does \"return error\".  The device is left started.\n\nThe HID core does not unwind on the driver's behalf.  __hid_device_probe()\nreleases the devres group, closes the report and clears hdev->driver:\n\n\tif (ret) {\n\t\tdevres_release_group(&hdev->dev, hdev->devres_group_id);\n\t\thid_close_report(hdev);\n\t\thdev->driver = NULL;\n\t}\n\nThe hidraw character device that hid_hw_start() registered through\nhid_connect() is allocated with kzalloc() and added with cdev_device_add(),\nso it is not devres-managed and survives that.  With hdev->driver NULL,\nhid_device_remove() skips hid_hw_stop() as well, because it only unwinds\nwhile a driver is still attached.  The registration therefore outlives the\ndevice on both paths.\n\nOpening the surviving /dev/hidrawX writes into freed memory.  KASAN reports\na use-after-free write from hidraw_open() -> hid_hw_open() -> the\ntransport's open callback, which takes a spinlock inside the freed object.\nA descriptor that carries a PID usage page and no input reports is enough:\nhidraw claims the device so hid_hw_start() succeeds, while hid->inputs\nstays empty so force-feedback init fails.  The other failure returns in\nhid_pidff_init_with_quirks() - no output reports, an allocation failure,\npidff_init_fields(), pidff_check_autocenter(), an unusable effect count,\ninput_ff_create() - all reach the same label.\n\nStop the device on that path.  hid-dr.c and hid-emsff.c, which start the\ndevice with the same HID_CONNECT_DEFAULT & ~HID_CONNECT_FF mask, already do\nthis.  The two earlier gotos must keep returning without hid_hw_stop(),\nsince neither has a started device, so give the path that fails after the\nstart its own label.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89624.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":208381,"id":"CVE-2026-89624","ts":1789997914204,"field":"cvss","old":"5.5","new":"7.8"},{"seq":208380,"id":"CVE-2026-89624","ts":1789997914204,"field":"severity","old":"medium","new":"high"},{"seq":202755,"id":"CVE-2026-89624","ts":1789403715637,"field":"cvss","old":"7.8","new":"5.5"},{"seq":202754,"id":"CVE-2026-89624","ts":1789403715637,"field":"severity","old":"high","new":"medium"},{"seq":197834,"id":"CVE-2026-89624","ts":1789384320595,"field":"cvss","old":"6.3","new":"7.8"},{"seq":197833,"id":"CVE-2026-89624","ts":1789384320595,"field":"severity","old":"medium","new":"high"},{"seq":183406,"id":"CVE-2026-89624","ts":1789356675234,"field":"cvss","old":"7.8","new":"6.3"},{"seq":183405,"id":"CVE-2026-89624","ts":1789356675234,"field":"severity","old":"high","new":"medium"},{"seq":153460,"id":"CVE-2026-89624","ts":1789285350600,"field":"cvss","old":null,"new":"7.8"},{"seq":153459,"id":"CVE-2026-89624","ts":1789285350600,"field":"severity","old":"none","new":"high"},{"seq":109606,"id":"CVE-2026-89624","ts":1789183732595,"field":"cvss","old":null,"new":"6.3"},{"seq":109605,"id":"CVE-2026-89624","ts":1789183732595,"field":"severity","old":"none","new":"medium"}]}