CVE-2026-80771: HID: nintendo: register input device after capabilities are set
In the Linux kernel, the following vulnerability has been resolved:
HID: nintendo: register input device after capabilities are set
inputregisterdevice() exposes the device to userspace immediately. In joyconinputcreate() it was called before joyconconfigrumble() configures the FFRUMBLE capability and the memless force-feedback device, so a concurrent EVIOCSFF could dereference a NULL dev->ff.
Registering early also means the initial udev event lacks button and axis information, which can make input managers ignore the device.
Move inputregisterdevice() to the end of joyconinputcreate(), after all capabilities, the IMU input device and the force-feedback callbacks have been configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.12-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.107-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.106 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.47 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.11 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Move input_register_device() after joycon_config_rumble() and completion of all capability, IMU, and force-feedback configuration so the device is not exposed to userspace before dev->ff is initialized.
Linux kernel HID Nintendo driver input_register_device() call order = Call input_register_device() at the end of joycon_input_create(), after all capabilities, the IMU input device, and force-feedback callbacks have been configured
Event History
Frequently Asked Questions
What conditions are required to trigger the NULL dereference?
The race occurs while joycon_input_create() is still initializing the device. A concurrent EVIOCSFF force-feedback request can reach the device before FF_RUMBLE capability and the memless force-feedback device have been configured, leaving dev->ff NULL.
Which systems are exposed to this initialization race?
Systems using the Linux Nintendo HID driver are exposed when a Nintendo input device is being created and registered. The vulnerable window exists because the device was made visible to userspace before force-feedback setup completed.
Are there non-crash symptoms that can indicate the issue?
Yes. Early registration causes the initial udev event to omit button and axis information, which can cause input managers to ignore the device. The corrected ordering registers the device only after its capabilities, IMU input device, and force-feedback callbacks are configured.