UBUNTU-CVE-2026-80770: Use After Free
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO before hidhwstop on probe failure nintendohidprobe() calls hiddeviceiostart() before joyconinit() and joyconledscreate(). If either fails, the error path jumps to errclose which calls hidhwclose()/hidhwstop() without first calling hiddeviceiostop(). hidhwstop() does not stop device IO, so hidinputreport() may still run and access driver data that is being torn down, resulting in a use-after-free. Add an erriostop label that calls hiddeviceiostop() before hidhwclose(), and point the two post-iostart error paths at it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add an err_io_stop label that calls hid_device_io_stop() before hid_hw_close(), and redirect both post-hid_device_io_start() error paths to it so device I/O stops before hid_hw_close()/hid_hw_stop().
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The affected software list includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What condition is required for the use-after-free to occur?
Device I/O must have started, followed by failure of either joycon_init() or joycon_leds_create() during device probing. Input reports can then continue while driver data is being torn down because device I/O was not stopped before hid_hw_stop().
Does this affect a successful device probe?
The described vulnerable paths are the two probe failure paths after hid_device_io_start() and before initialization completes. A successfully completed probe is not described as taking those teardown paths.