---
id: CVE-2026-31667
title: 'Input: uinput - fix circular locking dependency with ff-core'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Input: uinput - fix circular locking dependency with ff-core

  A lockdep circular locking dependency warning can be triggered
  reproducibly when using a force-feedback ga…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ff462551235d8d7d843a005950bc90924fcedede <
    71a9729f412e2c692a35c542e14b706fb342927f
  - >-
    Linux >= ff462551235d8d7d843a005950bc90924fcedede <
    271ee71a1917b89f6d73ec82dd091c33d92ee617
  - >-
    Linux >= ff462551235d8d7d843a005950bc90924fcedede <
    974f7b138c3a96dd5cd53d1b33409cd7b2229dc6
  - >-
    Linux >= ff462551235d8d7d843a005950bc90924fcedede <
    546c18a14924eb521fe168d916d7ce28f1e13c1d
  - >-
    Linux >= ff462551235d8d7d843a005950bc90924fcedede <
    a3d6c9c053c9c605651508569230ead633b13f76
  - >-
    Linux >= ff462551235d8d7d843a005950bc90924fcedede <
    1e09dfbb4f5d20ee111f92325a00f85778a5f328
  - >-
    Linux >= ff462551235d8d7d843a005950bc90924fcedede <
    1534661043c434b81cfde26b97a2fb2460329cf0
  - >-
    Linux >= ff462551235d8d7d843a005950bc90924fcedede <
    4cda78d6f8bf2b700529f2fbccb994c3e826d7c2
  - Linux 2.6.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:11:55.311439Z'
published: '2026-04-24'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:22.366Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31667'
references:
  - url: 'https://git.kernel.org/stable/c/71a9729f412e2c692a35c542e14b706fb342927f'
  - url: 'https://git.kernel.org/stable/c/271ee71a1917b89f6d73ec82dd091c33d92ee617'
  - url: 'https://git.kernel.org/stable/c/974f7b138c3a96dd5cd53d1b33409cd7b2229dc6'
  - url: 'https://git.kernel.org/stable/c/546c18a14924eb521fe168d916d7ce28f1e13c1d'
  - url: 'https://git.kernel.org/stable/c/a3d6c9c053c9c605651508569230ead633b13f76'
  - url: 'https://git.kernel.org/stable/c/1e09dfbb4f5d20ee111f92325a00f85778a5f328'
  - url: 'https://git.kernel.org/stable/c/1534661043c434b81cfde26b97a2fb2460329cf0'
  - url: 'https://git.kernel.org/stable/c/4cda78d6f8bf2b700529f2fbccb994c3e826d7c2'
tags:
  - cve.org
epss: 0.00136
epssPercentile: 0.0269
ingestedAt: '2026-10-16T17:24:46.669Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Input: uinput - fix circular locking dependency with ff-core

A lockdep circular locking dependency warning can be triggered
reproducibly when using a force-feedback gamepad with uinput (for
example, playing ELDEN RING under Wine with a Flydigi Vader 5
controller):

  ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex

The cycle is caused by four lock acquisition paths:

1. ff upload: input_ff_upload() holds ff->mutex and calls
   uinput_dev_upload_effect() -> uinput_request_submit() ->
   uinput_request_send(), which acquires udev->mutex.

2. device create: uinput_ioctl_handler() holds udev->mutex and calls
   uinput_create_device() -> input_register_device(), which acquires
   input_mutex.

3. device register: input_register_device() holds input_mutex and
   calls kbd_connect() -> input_register_handle(), which acquires
   dev->mutex.

4. evdev release: evdev_release() calls input_flush_device() under
   dev->mutex, which calls input_ff_flush() acquiring ff->mutex.

Fix this by introducing a new state_lock spinlock to protect
udev->state and udev->dev access in uinput_request_send() instead of
acquiring udev->mutex.  The function only needs to atomically check
device state and queue an input event into the ring buffer via
uinput_dev_event() -- both operations are safe under a spinlock
(ktime_get_ts64() and wake_up_interruptible() do not sleep).  This
breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in
the lock ordering and cannot form cycles with mutexes.

To keep state transitions visible to uinput_request_send(), protect
writes to udev->state in uinput_create_device() and
uinput_destroy_device() with the same state_lock spinlock.

Additionally, move init_completion(&request->done) from
uinput_request_send() to uinput_request_submit() before
uinput_request_reserve_slot().  Once the slot is allocated,
uinput_flush_requests() may call complete() on it at any time from
the destroy path, so the completion must be initialised before the
request becomes visible.

Lock ordering after the fix:

  ff->mutex -> state_lock (spinlock, leaf)
  udev->mutex -> state_lock (spinlock, leaf)
  udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)

## Affected

- `Linux >= ff462551235d8d7d843a005950bc90924fcedede < 71a9729f412e2c692a35c542e14b706fb342927f`
- `Linux >= ff462551235d8d7d843a005950bc90924fcedede < 271ee71a1917b89f6d73ec82dd091c33d92ee617`
- `Linux >= ff462551235d8d7d843a005950bc90924fcedede < 974f7b138c3a96dd5cd53d1b33409cd7b2229dc6`
- `Linux >= ff462551235d8d7d843a005950bc90924fcedede < 546c18a14924eb521fe168d916d7ce28f1e13c1d`
- `Linux >= ff462551235d8d7d843a005950bc90924fcedede < a3d6c9c053c9c605651508569230ead633b13f76`
- `Linux >= ff462551235d8d7d843a005950bc90924fcedede < 1e09dfbb4f5d20ee111f92325a00f85778a5f328`
- `Linux >= ff462551235d8d7d843a005950bc90924fcedede < 1534661043c434b81cfde26b97a2fb2460329cf0`
- `Linux >= ff462551235d8d7d843a005950bc90924fcedede < 4cda78d6f8bf2b700529f2fbccb994c3e826d7c2`
- `Linux 2.6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.