CVE-2026-80770
Received Received - Intake

HID Device IO Use-After-Free in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO before hid_hw_stop on probe failure nintendo_hid_probe() calls hid_device_io_start() before joycon_init() and joycon_leds_create(). If either fails, the error path jumps to err_close which calls hid_hw_close()/hid_hw_stop() without first calling hid_device_io_stop(). hid_hw_stop() does not stop device IO, so hid_input_report() may still run and access driver data that is being torn down, resulting in a use-after-free. Add an err_io_stop label that calls hid_device_io_stop() before hid_hw_close(), and point the two post-io_start error paths at it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80770
EUVD
EUVD-2026-71413

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nintendo linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's HID driver for Nintendo devices. During probe failure, the driver fails to properly stop device I/O before tearing down resources, allowing the device to continue sending input reports that access freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID driver for Nintendo devices. Detection requires checking kernel logs for errors related to nintendo_hid_probe() or use-after-free crashes. Commands like dmesg | grep -i nintendo or journalctl -k | grep -i nintendo may help identify issues.

Impact Analysis

This could lead to system crashes, arbitrary code execution, or privilege escalation if exploited. Users running affected Linux kernels with Nintendo HID devices may experience instability or security breaches.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's HID driver for Nintendo devices. It does not directly relate to data protection or privacy compliance standards like GDPR or HIPAA, as it involves kernel memory corruption rather than unauthorized data access or exposure.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for CVE-2026-80770. If immediate patching is not possible, disable the nintendo HID driver by blacklisting it or unloading the module if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart