CVE-2026-43049

HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure

State: Published
Severity: Not scored
Published: May 1, 2026
Updated: Oct 30, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure

Presently, if the force feedback initialisation fails when probing the Logitech G920 Driving Force Racing Wheel for Xbox One, an error number will be returned and propagated before the userspace infrastructure (sysfs and /dev/input) has been torn down. If userspace ignores the errors and continues to use its references to these dangling entities, a UAF will promptly follow.

We have 2 options; continue to return the error, but ensure that all of the infrastructure is torn down accordingly or continue to treat this condition as a warning by emitting the message but returning success. It is thought that the original author's intention was to emit the warning but keep the device functional, less the force feedback feature, so let's go with that.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before 222bcf7b02899250b20a7a02d29b4e89fe537322Affected abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before df966f0def87550bd81d0892cdff992202de2712Affected abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before 772f99cc8d6e5d95613bce93c9624e154c1abe88Affected abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before b846fb0a73e99174f08238e083e284c0463a2102Affected abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before 9a793ac19eb84f44ed759c0fce80cf29bc2a2453Affected abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before f7a4c78bfeb320299c1b641500fe7761eadbd101Affected 5f7fd3576cf30d502a8b2aec4e7a49c4f894e253Affected 5.3.9 to before 5.4Affected
LinuxLinux	5.4Affected before 5.4Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before 222bcf7b02899250b20a7a02d29b4e89fe537322Affected
abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before df966f0def87550bd81d0892cdff992202de2712Affected
abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before 772f99cc8d6e5d95613bce93c9624e154c1abe88Affected
abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before b846fb0a73e99174f08238e083e284c0463a2102Affected
abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before 9a793ac19eb84f44ed759c0fce80cf29bc2a2453Affected
abdd3d0b344fdf72a4904d09b97bc964d74c4419 to before f7a4c78bfeb320299c1b641500fe7761eadbd101Affected
5f7fd3576cf30d502a8b2aec4e7a49c4f894e253Affected
5.3.9 to before 5.4Affected

LinuxLinux

5.4Affected
before 5.4Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.