CVE-2026-80771
Description
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input_register_device() exposes the device to userspace immediately. In joycon_input_create() it was called before joycon_config_rumble() configures the FF_RUMBLE capability and the memless force-feedback device, so a concurrent EVIOCSFF could dereference a NULL dev->ff. Registering early also means the initial udev event lacks button and axis information, which can make input managers ignore the device. Move input_register_device() to the end of joycon_input_create(), after all capabilities, the IMU input device and the force-feedback callbacks have been configured.
How to fix
- Linux Linuxa2a46a705c1fa724aac158fd188273dd7ee8c171, 3288bec1a21d582b504344380139cdc0e88ebe4d, 268679f501386ad46405d42c2bcf89384cb5e256, a9fc7547f911ada09da33c5e204e5acda38e765a, 27dc4b8eadac73b3c3cc526c8547d8b4ae8528be, d723bc1fe2e72b9252234e94c11af644ec477bf7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 2af16c1f846bd60240745bbd3afa13d5f040c61a ≤ v < a2a46a705c1fa724aac158fd188273dd7ee8c171, 2af16c1f846bd60240745bbd3afa13d5f040c61a ≤ v < 3288bec1a21d582b504344380139cdc0e88ebe4d, 2af16c1f846bd60240745bbd3afa13d5f040c61a ≤ v < 268679f501386ad46405d42c2bcf89384cb5e256, 2af16c1f846bd60240745bbd3afa13d5f040c61a ≤ v < a9fc7547f911ada09da33c5e204e5acda38e765a, 2af16c1f846bd60240745bbd3afa13d5f040c61a ≤ v < 27dc4b8eadac73b3c3cc526c8547d8b4ae8528be, 2af16c1f846bd60240745bbd3afa13d5f040c61a ≤ v < d723bc1fe2e72b9252234e94c11af644ec477bf7, 5.16 | a2a46a705c1fa724aac158fd188273dd7ee8c171, 3288bec1a21d582b504344380139cdc0e88ebe4d, 268679f501386ad46405d42c2bcf89384cb5e256, a9fc7547f911ada09da33c5e204e5acda38e765a, 27dc4b8eadac73b3c3cc526c8547d8b4ae8528be, d723bc1fe2e72b9252234e94c11af644ec477bf7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.