UBUNTU-CVE-2026-90041: Medium severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list on probe failure sonyinputconfigured() adds some controllers to sonydevicelist before HID core registers their input devices. inputregisterdevice() can fail after the callback returns successfully. sonyprobe() then observes that HIDCLAIMEDINPUT is clear and unwinds, but only stops the HID hardware. The devres-managed sonysc is freed while its list node remains linked, so the next matching controller traverses freed memory. Initialize the list node and device ID to inactive states. Make list removal idempotent and run the driver-private cleanup on every probe failure path. This also makes a second cleanup safe when sonyinputconfigured() already unwound a partial initialization before sonyprobe() handles the missing input claim. Found by 0sec (https://0sec.ai) using automated source analysis; verified against the HID input registration and probe unwind paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel HID Sony driver, initialize the list node and device ID to inactive states, make list removal idempotent, and run driver-private cleanup on every probe-failure path, including when input_register_device() fails or HID_CLAIMED_INPUT is clear.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the affected Ubuntu Linux kernel packages are exposed when Sony HID controllers are handled by the HID Sony driver. The listed packages include linux, linux-azure, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-gcp, and linux-oracle.
What conditions are required to trigger the vulnerability?
A Sony controller must be added to the driver's device list during probe, followed by a failure to register its input device. A later matching controller can then cause the driver to traverse the stale list entry pointing to freed memory.
Is attacker authentication or user interaction required?
The supplied vector indicates no privileges and no user interaction are required. Exploitation nevertheless depends on reaching the Sony HID probe failure path described in the advisory.
What is the impact if the issue is triggered?
The stale list node creates a use-after-free condition when a subsequent matching controller is processed. The provided impact metrics indicate high impact to confidentiality, integrity, and availability of the vulnerable system.
How does the fix prevent the stale entry?
The fix initializes the list node and device ID as inactive, makes removal safe to perform more than once, and runs driver-private cleanup on every probe failure path. This removes the device-list entry before the devres-managed driver state is freed.