---
id: CVE-2026-80771
title: 'HID: nintendo: register input device after capabilities are set'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: nintendo: register input device after capabilities are set

  input_register_device() exposes the device to userspace immediately.
  In joycon_input_create() it was ca…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a <
    3288bec1a21d582b504344380139cdc0e88ebe4d
  - >-
    Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a <
    268679f501386ad46405d42c2bcf89384cb5e256
  - >-
    Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a <
    a9fc7547f911ada09da33c5e204e5acda38e765a
  - >-
    Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a <
    27dc4b8eadac73b3c3cc526c8547d8b4ae8528be
  - >-
    Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a <
    d723bc1fe2e72b9252234e94c11af644ec477bf7
  - Linux 5.16
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:43:27.721Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80771'
references:
  - url: 'https://git.kernel.org/stable/c/3288bec1a21d582b504344380139cdc0e88ebe4d'
  - url: 'https://git.kernel.org/stable/c/268679f501386ad46405d42c2bcf89384cb5e256'
  - url: 'https://git.kernel.org/stable/c/a9fc7547f911ada09da33c5e204e5acda38e765a'
  - url: 'https://git.kernel.org/stable/c/27dc4b8eadac73b3c3cc526c8547d8b4ae8528be'
  - url: 'https://git.kernel.org/stable/c/d723bc1fe2e72b9252234e94c11af644ec477bf7'
tags:
  - cve.org
epss: 0.00209
epssPercentile: 0.10319
ingestedAt: '2026-10-19T10:20:54.953Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

HID: nintendo: register input device after capabilities are set

input_register_device() exposes the device to userspace immediately.
In joycon_input_create() it was called before joycon_config_rumble()
configures the FF_RUMBLE capability and the memless force-feedback
device, so a concurrent EVIOCSFF could dereference a NULL dev->ff.

Registering early also means the initial udev event lacks button and
axis information, which can make input managers ignore the device.

Move input_register_device() to the end of joycon_input_create(), after
all capabilities, the IMU input device and the force-feedback callbacks
have been configured.

## Affected

- `Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < 3288bec1a21d582b504344380139cdc0e88ebe4d`
- `Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < 268679f501386ad46405d42c2bcf89384cb5e256`
- `Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < a9fc7547f911ada09da33c5e204e5acda38e765a`
- `Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < 27dc4b8eadac73b3c3cc526c8547d8b4ae8528be`
- `Linux >= 2af16c1f846bd60240745bbd3afa13d5f040c61a < d723bc1fe2e72b9252234e94c11af644ec477bf7`
- `Linux 5.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.