« Volver al listado

CVE-2026-80770

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

HID: nintendo: stop device IO before hid_hw_stop on probe failure

nintendo_hid_probe() calls hid_device_io_start() before joycon_init() and joycon_leds_create(). If either fails, the error path jumps to err_close which calls hid_hw_close()/hid_hw_stop() without first calling hid_device_io_stop().

hid_hw_stop() does not stop device IO, so hid_input_report() may still run and access driver data that is being torn down, resulting in a use-after-free.

Add an err_io_stop label that calls hid_device_io_stop() before hid_hw_close(), and point the two post-io_start error paths at it.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80770",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2af16c1f846bd60240745bbd3afa13d5f040c61a",
              "lessThan": "c2f3d51c7f5222f5b51e0c90f02258d82e1b44dd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2af16c1f846bd60240745bbd3afa13d5f040c61a",
              "lessThan": "c023443f0e6cfd257846b6515c93c1ea08026593",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2af16c1f846bd60240745bbd3afa13d5f040c61a",
              "lessThan": "03a84f9f88b42cd49752ec0259922b67e4b88598",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2af16c1f846bd60240745bbd3afa13d5f040c61a",
              "lessThan": "5efcd7bbfaaec67d137c99aa0940fa34375db27f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2af16c1f846bd60240745bbd3afa13d5f040c61a",
              "lessThan": "13a3edf96568a0b7aacadea07c2adec53ac8f630",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2af16c1f846bd60240745bbd3afa13d5f040c61a",
              "lessThan": "2e0d98dc8a6dea5fc2b72bf66e0dcbd5488644b4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2af16c1f846bd60240745bbd3afa13d5f040c61a",
              "lessThan": "1f74d3bff6fe04a64e02ab3661d2e0d554565aa6",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-nintendo.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-nintendo.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-04T16:18:02.483",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/03a84f9f88b42cd49752ec0259922b67e4b88598",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/13a3edf96568a0b7aacadea07c2adec53ac8f630",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1f74d3bff6fe04a64e02ab3661d2e0d554565aa6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2e0d98dc8a6dea5fc2b72bf66e0dcbd5488644b4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5efcd7bbfaaec67d137c99aa0940fa34375db27f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c023443f0e6cfd257846b6515c93c1ea08026593",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c2f3d51c7f5222f5b51e0c90f02258d82e1b44dd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: nintendo: stop device IO before hid_hw_stop on probe failure\n\nnintendo_hid_probe() calls hid_device_io_start() before joycon_init()\nand joycon_leds_create().  If either fails, the error path jumps to\nerr_close which calls hid_hw_close()/hid_hw_stop() without first calling\nhid_device_io_stop().\n\nhid_hw_stop() does not stop device IO, so hid_input_report() may still\nrun and access driver data that is being torn down, resulting in a\nuse-after-free.\n\nAdd an err_io_stop label that calls hid_device_io_stop() before\nhid_hw_close(), and point the two post-io_start error paths at it."
    }
  ],
  "lastModified": "2026-09-04T16:18:02.483",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}