CVE-2026-80770: HID: nintendo: stop device IO before hid_hw_stop on probe failure
In the Linux kernel, the following vulnerability has been resolved:
HID: nintendo: stop device IO before hidhwstop on probe failure
nintendohidprobe() calls hiddeviceiostart() before joyconinit() and joyconledscreate(). If either fails, the error path jumps to errclose which calls hidhwclose()/hidhwstop() without first calling hiddeviceiostop().
hidhwstop() does not stop device IO, so hidinputreport() may still run and access driver data that is being torn down, resulting in a use-after-free.
Add an erriostop label that calls hiddeviceiostop() before hidhwclose(), and point the two post-iostart error paths at it.
Affected Software
Event History
Frequently Asked Questions
When can the use-after-free occur?
It can occur when nintendo_hid_probe() has started device I/O and then either joycon_init() or joycon_leds_create() fails. The affected error path tears down driver data while input reports may still be processed.
What condition must be present for an attacker or triggering event to reach the vulnerable path?
The failure must happen after hid_device_io_start() and during joycon_init() or joycon_leds_create(). The provided information does not identify a remote attack vector, required privileges, or specific device interaction needed to induce those failures.
What is the relevant mitigation if the fix cannot be applied immediately?
The described flaw is in the Nintendo HID driver probe failure path. The provided data does not specify a supported configuration workaround or mitigation other than applying the resolved change that stops device I/O before hardware teardown.