CVE-2026-80771 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: nintendo: register input device after capabilities are set
input_register_device() exposes the device to userspace immediately. In joycon_input_create() it was called before joycon_config_rumble() configures the FF_RUMBLE capability and the memless force-feedback device, so a concurrent EVIOCSFF could dereference a NULL dev->ff.
Registering early also means the initial udev event lacks button and axis information, which can make input managers ignore the device.
Move input_register_device() to the end of joycon_input_create(), after all capabilities, the IMU input device and the force-feedback callbacks have been configured.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in the Linux kernel's HID Nintendo driver involves a critical race condition related to the initialization sequence of input devices, specifically affecting Joy-Con controllers. The core issue stems from calling input_register_device() before all hardware capabilities and subsystems are fully initialized. In the function joycon_input_create(), this registration call was placed prior to the invocation of joycon_config_rumble(). This ordering error exposes an uninitialized device structure to userspace prematurely, creating a window where external processes can interact with the device while it is in a partially configured state.
The technical flaw manifests when a user-space application attempts to configure force-feedback effects via the EVIOCSFF ioctl command during this initialization window. Because joycon_config_rumble() has not yet executed, the driver's internal structure for handling force feedback remains unallocated or null. Consequently, any attempt by userspace to set up rumble capabilities results in a NULL pointer dereference of dev->ff. This leads to an immediate kernel panic or system crash, effectively causing a denial of service condition that can be triggered locally by any user with access to the input device interface.
Beyond the stability issue caused by the null pointer dereference, there is a significant functional impact related to device enumeration and integration within the operating system. Registering the input device before all capabilities are set means that the initial udev event sent to userspace lacks critical information regarding buttons and axes. Modern input managers rely on this metadata to properly identify and configure devices. Without accurate axis and button data in the initial announcement, these managers may ignore or misconfigure the Joy-Con controller, leading to a degraded user experience where controls do not function as expected even if the kernel itself remains stable.
The resolution involves reordering the initialization steps within joycon_input_create() to ensure that input_register_device() is called only after all subsystems are fully configured. This includes setting up force-feedback callbacks via joycon_config_rumble(), initializing the IMU (Inertial Measurement Unit) input device, and defining all other hardware capabilities. By deferring registration until the end of the creation process, the driver guarantees that userspace interactions occur against a complete and stable device structure, eliminating both the race condition vulnerability and the incomplete metadata issue.
From a security classification perspective, this flaw aligns with CWE-416: Use After Free or NULL Pointer Dereference, as it involves accessing an uninitialized pointer due to improper sequencing of resource allocation and exposure. Additionally, the operational impact relates to availability, which is a key component of the CIA triad often mapped within MITRE ATT&CK techniques related to Denial of Service through local exploitation. Mitigation for this issue requires applying kernel updates that include the corrected initialization sequence in the HID Nintendo driver. System administrators should ensure their systems are patched with versions containing this fix to prevent potential crashes and ensure proper device functionality for connected Nintendo peripherals.