CVE-2026-90041: HID: sony: clean up device list on probe failure
In the Linux kernel, the following vulnerability has been resolved:
HID: sony: clean up device list on probe failure
sonyinputconfigured() adds some controllers to sonydevicelist before HID core registers their input devices. inputregisterdevice() can fail after the callback returns successfully. sonyprobe() then observes that HIDCLAIMEDINPUT is clear and unwinds, but only stops the HID hardware. The devres-managed sonysc is freed while its list node remains linked, so the next matching controller traverses freed memory.
Initialize the list node and device ID to inactive states. Make list removal idempotent and run the driver-private cleanup on every probe failure path. This also makes a second cleanup safe when sonyinputconfigured() already unwound a partial initialization before sonyprobe() handles the missing input claim.
Found by 0sec (https://0sec.ai) using automated source analysis; verified against the HID input registration and probe unwind paths.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's Sony HID driver are exposed when a matching controller is probed and its input-device registration fails during initialization.
What sequence is required for the stale list entry to be used?
A controller probe must fail after the driver has added the controller to its internal device list but before HID input is successfully claimed. A later probe of another matching controller can then traverse the freed list entry.