CVE-2026-98645
Received Received - Intake

Use-After-Free in Linux Kernel HID Winwing Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwing_init_ff() passes the driver's private data, allocated with devm_kzalloc() in winwing_probe(), as the effect context to input_ff_create_memless(). The memoryless force-feedback core takes ownership of that pointer and frees it with kfree() from input_ff_destroy() (ml_ff_destroy()) when the input device is destroyed. Freeing a devm-managed allocation with kfree() is an invalid free, and the same object is then released again by devres when the HID device is torn down, a double free. As the allocation also embeds the LED class devices, their timers and work item live on freed memory and the slab gets corrupted. This triggers on unbind, rmmod, hot-unplug and on system suspend, where the firmware cache walks the now-corrupt devres list. KASAN reports: BUG: KASAN: invalid-free in input_ff_destroy Allocated by task N: winwing_probe Pass NULL as the memless context instead and fetch the driver data from the input device in winwing_play_effect(): the HID core already stores the hid_device as the input device's drvdata. The force-feedback core then owns nothing that it must not free.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98645
EUVD
EUVD-2026-103559

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 42d020b54edc57d03749bed75976f1e962a9fbfa
Linux Linux 42d020b54edc57d03749bed75976f1e962a9fbfa
Linux Linux 7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's HID winwing driver. It occurs when the driver's private data, allocated with devm_kzalloc(), is passed to input_ff_create_memless() which frees it later. This causes a double free when devres also releases the same memory during device teardown, corrupting the slab and triggering KASAN errors.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID subsystem and affects the winwing driver. Detection requires checking for kernel logs indicating double-free errors or slab corruption during HID device unbind, rmmod, hot-unplug, or system suspend events. Monitor dmesg for KASAN reports mentioning invalid-free in input_ff_destroy.

Impact Analysis

This vulnerability can cause system instability, crashes, or unexpected behavior when unloading the HID winwing driver module, unplugging the device, or during system suspend. It may lead to kernel panics or data corruption due to slab corruption.

Mitigation Strategies

Apply the Linux kernel patch that fixes the use-after-free in the winwing driver. Update to a kernel version containing the fix. If using a custom kernel, rebuild it with the patch applied. Avoid unbinding or removing HID devices until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98645. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart