CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event()
In the Linux kernel, the following vulnerability has been resolved:
HID: hidpp: fix potential UAF in hidppconnectevent()
If inputregisterdevice() fails, we call inputfreedevice(), but keep stale pointer to the old device in hidpp->input, which could potentially lead to UAF. Fix that by resetting it to NULL before returning from hidppconnectevent().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Reset hidpp->input to NULL before returning when input_register_device() fails, after calling input_free_device(), to prevent a use-after-free.
Linux kernel HID++ driver hidpp->input = NULL
Event History
Frequently Asked Questions
Is successful HID input-device registration enough to trigger this issue?
The stale pointer is created only when input_register_device() fails and the associated input device is freed. The provided information does not indicate that the successful registration path is affected.
How can maintainers verify that a kernel contains the fix?
Check whether the hidpp_connect_event() failure path clears hidpp->input to NULL before returning after input_register_device() fails. The referenced stable commits can also be used to compare source or backports, but no fixed kernel versions are provided.