CVE-2026-90330: HID: logitech-hidpp: Fix FF device cleanup on init failure
HID: logitech-hidpp: Fix FF device cleanup on init failure
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1
Event History
Frequently Asked Questions
Under what condition does the cleanup issue occur?
It occurs when input_ff_create() succeeds during hidpp_ff_init(), but a later allocation of the HID++ force-feedback private data, effect ID array, or workqueue fails.
What does the fix clean up on an initialization failure?
The added unwind path frees the private allocations made by hidpp_ff_init() and destroys the force-feedback device with input_ff_destroy().
Where are the referenced fixes available?
The provided stable kernel references are commits 13378c9ac0a1bcdf49ba158e4199594aafb589cd and dd5be4d9ce2dfc4d4a4527ef7d31d21a78e3cdac.