Cloudanix VulnDB

CVE-2026-80770

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A programming mistake in how Linux handles certain game controllers can let a local user crash the system or potentially run code with full system privileges.

Chainable
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free in the nintendo HID driver when probe fails after hid_device_io_start() but before error handling calls hid_device_io_stop(), allowing hid_input_report() to access driver data being torn down during hid_hw_stop().

Why it matters to the business

Kernel memory corruption on Linux systems using Nintendo Joy-Con or similar controllers can lead to crashes, denial of service, or local privilege escalation; the issue is present in mainline kernels until patched.

How an attack unfolds

An attacker with local access or ability to attach a Nintendo HID device triggers nintendo_hid_probe(), forces an error in joycon_init() or joycon_leds_create() after IO start, and races the teardown path so that a pending input report accesses freed structures.

How to fix it

Apply the upstream fix that adds an err_io_stop label calling hid_device_io_stop() before hid_hw_close; rebuild and deploy updated kernel packages containing the commit resolving the missing IO stop on probe failure paths.

How to confirm the fix worked

Inspect nintendo.c source for the err_io_stop label and hid_device_io_stop() call before hid_hw_close in the probe error path; verify running kernel contains the resolution via git log or version string.

Typical attack path

  1. Attach or simulate Nintendo HID device to trigger probe
  2. Induce failure in joycon_init or joycon_leds_create after hid_device_io_start
  3. Allow hid_input_report to execute concurrently during err_close path
  4. Access freed driver data leading to UAF

How to detect it

Review kernel logs for oops/panic traces referencing nintendo_hid_probe, hid_input_report, and use-after-free in the HID teardown path; correlate with recent device attach events for Nintendo controllers.

What your security team should do

  • Prioritize kernel update containing the nintendo HID probe fix on all affected Linux distributions
  • Monitor for kernel oops or panic logs involving hid_input_report and nintendo driver structures
  • Restrict untrusted local users from attaching arbitrary HID devices until patched

The record

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO before hid_hw_stop on probe failure nintendo_hid_probe() calls hid_device_io_start() before joycon_init() and joycon_leds_create(). If either fails, the error path jumps to err_close which calls hid_hw_close()/hid_hw_stop() without first calling hid_device_io_stop(). hid_hw_stop() does not stop device IO, so hid_input_report() may still run and access driver data that is being torn down, resulting in a use-after-free. Add an err_io_stop label that calls hid_device_io_stop() before hid_hw_close(), and point the two post-io_start error paths at it.

Affected packages

Ecosystem Package Introduced Fixed