CVE-2026-90330: HID: logitech-hidpp: Fix FF device cleanup on init failure
In the Linux kernel, the following vulnerability has been resolved:
HID: logitech-hidpp: Fix FF device cleanup on init failure
hidppffinit() creates the input force-feedback device with inputffcreate(), then allocates the HID++ FF private data, effect ID array, and workqueue.
If any of those allocations fail after inputffcreate() succeeds, the function returns an error without destroying the FF device. Add an unwind path that frees the private allocations made by hidppffinit() and calls inputffdestroy() for failures after inputffcreate() succeeds.
Affected Software
Event History
Frequently Asked Questions
Under what condition does the cleanup issue occur?
It occurs when input_ff_create() succeeds during hidpp_ff_init(), but a later allocation of the HID++ force-feedback private data, effect ID array, or workqueue fails.
What does the fix clean up on an initialization failure?
The added unwind path frees the private allocations made by hidpp_ff_init() and destroys the force-feedback device with input_ff_destroy().
Where are the referenced fixes available?
The provided stable kernel references are commits 13378c9ac0a1bcdf49ba158e4199594aafb589cd and dd5be4d9ce2dfc4d4a4527ef7d31d21a78e3cdac.