Cloudanix VulnDB

CVE-2026-80771

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in the way the operating system sets up Nintendo game controllers could let a local user crash the machine or cause the controllers to be ignored.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in HID nintendo driver where input_register_device() is invoked before joycon_config_rumble() populates FF_RUMBLE capability and memless force-feedback callbacks, allowing concurrent EVIOCSFF ioctl to dereference NULL dev->ff; early registration also omits button/axis details from initial udev event.

Why it matters to the business

Systems using Nintendo Joy-Con or similar controllers risk kernel instability, crashes, or non-functional input devices until patched; low exploitability but affects Linux gaming and embedded controller support.

How an attack unfolds

Local attacker with access to the input subsystem times an EVIOCSFF ioctl against the window between device registration and rumble capability setup, triggering NULL dereference; alternatively, malformed udev events cause input managers to ignore the device.

How to fix it

Update Linux kernel to a version containing the fix that moves input_register_device() after all capabilities, IMU, and force-feedback setup are complete; rebuild and reboot with patched kernel image.

How to confirm the fix worked

Confirm kernel source contains the reordered registration call at the end of joycon_input_create(); test controller hot-plug and force-feedback functionality under concurrent ioctl load; verify udev events now include full button and axis capabilities.

Typical attack path

  1. Obtain local unprivileged access on affected Linux system
  2. Attach Nintendo HID controller to trigger joycon_input_create()
  3. Race EVIOCSFF ioctl with input_register_device() call
  4. Trigger NULL pointer dereference or incomplete device exposure

How to detect it

Review kernel logs for NULL pointer dereference traces involving joycon or nintendo HID force-feedback paths; inspect udev event timing and missing capability attributes on input device registration; correlate with local process activity issuing EVIOCSFF ioctls during device attach.

What your security team should do

  • Prioritize kernel update on all systems exposing HID input devices to users
  • Monitor for local privilege-escalation attempts via input subsystem
  • Disable unnecessary Nintendo HID drivers if controllers are not required

The record

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input_register_device() exposes the device to userspace immediately. In joycon_input_create() it was called before joycon_config_rumble() configures the FF_RUMBLE capability and the memless force-feedback device, so a concurrent EVIOCSFF could dereference a NULL dev->ff. Registering early also means the initial udev event lacks button and axis information, which can make input managers ignore the device. Move input_register_device() to the end of joycon_input_create(), after all capabilities, the IMU input device and the force-feedback callbacks have been configured.

Affected packages

Ecosystem Package Introduced Fixed