UBUNTU-CVE-2026-80771: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set inputregisterdevice() exposes the device to userspace immediately. In joyconinputcreate() it was called before joyconconfigrumble() configures the FFRUMBLE capability and the memless force-feedback device, so a concurrent EVIOCSFF could dereference a NULL dev->ff. Registering early also means the initial udev event lacks button and axis information, which can make input managers ignore the device. Move inputregisterdevice() to the end of joyconinputcreate(), after all capabilities, the IMU input device and the force-feedback callbacks have been configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Move input_register_device() to the end of joycon_input_create(), after joycon_config_rumble() has configured FF_RUMBLE and the memless force-feedback device, to prevent concurrent EVIOCSFF access from dereferencing a NULL dev->ff.
Linux kernel HID Nintendo driver input_register_device() ordering in joycon_input_create() = Register after all capabilities, the IMU input device, and force-feedback callbacks are configured
Event History
Frequently Asked Questions
What must occur for the NULL dereference to be triggered?
A userspace process must issue an EVIOCSFF force-feedback request concurrently while the Joy-Con input device is being created. The race exists because the device was exposed to userspace before its FF_RUMBLE capability and memless force-feedback device were configured.
Can this issue affect device discovery even if the force-feedback race is not triggered?
Yes. Early registration can emit the initial udev event before button and axis capabilities are present, which may cause input managers to ignore the device.