CVE-2026-90041

HID: sony: clean up device list on probe failure

State: Published
Severity: 8.8 High
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: sony: clean up device list on probe failure

sony_input_configured() adds some controllers to sony_device_list before HID core registers their input devices. input_register_device() can fail after the callback returns successfully. sony_probe() then observes that HID_CLAIMED_INPUT is clear and unwinds, but only stops the HID hardware. The devres-managed sony_sc is freed while its list node remains linked, so the next matching controller traverses freed memory.

Initialize the list node and device ID to inactive states. Make list removal idempotent and run the driver-private cleanup on every probe failure path. This also makes a second cleanup safe when sony_input_configured() already unwound a partial initialization before sony_probe() handles the missing input claim.

Found by 0sec (https://0sec.ai) using automated source analysis; verified against the HID input registration and probe unwind paths.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4f967f6d73746f66514528cc1191025f0b5d69b3 to before 41d92c2e02788c04663b11335454b094dc4672bcAffected 4f967f6d73746f66514528cc1191025f0b5d69b3 to before 7ee50d42a6d5c8cf3d8afb3285273bcc58452214Affected 4f967f6d73746f66514528cc1191025f0b5d69b3 to before b84544ef00a27e8081498d33af7dac33b6cb8418Affected 4f967f6d73746f66514528cc1191025f0b5d69b3 to before 3b4709e4864908bb06c48c500cc8db8d3d55d139Affected 4f967f6d73746f66514528cc1191025f0b5d69b3 to before d044d796e2a369c6051c7e83dce88c7baa2494d4Affected 4f967f6d73746f66514528cc1191025f0b5d69b3 to before 7c65699a3a311198a07659a614fe64d45924839eAffected
LinuxLinux	4.10Affected before 4.10Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4f967f6d73746f66514528cc1191025f0b5d69b3 to before 41d92c2e02788c04663b11335454b094dc4672bcAffected
4f967f6d73746f66514528cc1191025f0b5d69b3 to before 7ee50d42a6d5c8cf3d8afb3285273bcc58452214Affected
4f967f6d73746f66514528cc1191025f0b5d69b3 to before b84544ef00a27e8081498d33af7dac33b6cb8418Affected
4f967f6d73746f66514528cc1191025f0b5d69b3 to before 3b4709e4864908bb06c48c500cc8db8d3d55d139Affected
4f967f6d73746f66514528cc1191025f0b5d69b3 to before d044d796e2a369c6051c7e83dce88c7baa2494d4Affected
4f967f6d73746f66514528cc1191025f0b5d69b3 to before 7c65699a3a311198a07659a614fe64d45924839eAffected

LinuxLinux

4.10Affected
before 4.10Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.