CVE-2026-80771: HID: nintendo: register input device after capabilities are set
In the Linux kernel, the following vulnerability has been resolved:
HID: nintendo: register input device after capabilities are set
inputregisterdevice() exposes the device to userspace immediately. In joyconinputcreate() it was called before joyconconfigrumble() configures the FFRUMBLE capability and the memless force-feedback device, so a concurrent EVIOCSFF could dereference a NULL dev->ff.
Registering early also means the initial udev event lacks button and axis information, which can make input managers ignore the device.
Move inputregisterdevice() to the end of joyconinputcreate(), after all capabilities, the IMU input device and the force-feedback callbacks have been configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
After applying the kernel fix for HID Joy-Con (moving input_register_device() to the end of joycon_input_create() after joycon_config_rumble()/capability and force-feedback configuration), verify that the initial udev event includes button and all capabilities, the IMU input device, and force-feedback (FF_RUMBLE/memless) axis information so input managers will not ignore the device.
Event History
Frequently Asked Questions
What conditions are required to trigger the NULL dereference?
The race occurs while joycon_input_create() is still initializing the device. A concurrent EVIOCSFF force-feedback request can reach the device before FF_RUMBLE capability and the memless force-feedback device have been configured, leaving dev->ff NULL.
Which systems are exposed to this initialization race?
Systems using the Linux Nintendo HID driver are exposed when a Nintendo input device is being created and registered. The vulnerable window exists because the device was made visible to userspace before force-feedback setup completed.
Are there non-crash symptoms that can indicate the issue?
Yes. Early registration causes the initial udev event to omit button and axis information, which can cause input managers to ignore the device. The corrected ordering registers the device only after its capabilities, IMU input device, and force-feedback callbacks are configured.