Cloudanix VulnDB

CVE-2026-90330

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A setup error in certain Logitech input devices could leave the operating system in an unstable state if resources run out during initialization.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Missing unwind path after input_ff_create() succeeds in hidpp_ff_init() leaves allocated private data, effect ID arrays, and workqueues unreleased and fails to call input_ff_destroy() on subsequent allocation failures, producing resource leaks or dangling kernel objects.

Why it matters to the business

Systems using Logitech force-feedback devices may experience memory exhaustion, kernel panics, or degraded input-device functionality until the kernel is updated, increasing unplanned downtime and support costs.

How an attack unfolds

An attacker with local access induces allocation pressure or device re-initialization that triggers the failure path after the force-feedback device has been created, then leverages the resulting leaked or dangling structures to corrupt kernel memory or trigger a crash.

How to fix it

Update the Linux kernel to a version that includes the corrected hidpp_ff_init() unwind logic calling input_ff_destroy() on allocation failures.

How to confirm the fix worked

Inspect the hidpp_ff_init() function in the running kernel source or binary for the presence of an error path that invokes input_ff_destroy() after input_ff_create() and frees all subsequently allocated structures.

Typical attack path

  1. Obtain local execution on a Linux system with a Logitech HID++ device
  2. Trigger repeated hidpp_ff_init() calls that succeed at input_ff_create() but fail on later allocations
  3. Abuse unreleased objects or dangling pointers for memory corruption or denial of service

How to detect it

Search kernel logs and dmesg output for hidpp_ff_init error paths that mention allocation failures without subsequent input_ff_destroy calls; monitor for repeated Logitech force-feedback device registration attempts.

What your security team should do

  • Prioritize kernel package updates on all systems exposing Logitech HID++ devices
  • Reboot affected hosts after applying updates to load the corrected driver
  • Review kernel crash logs for hidpp_ff_init-related allocation failures until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix FF device cleanup on init failure hidpp_ff_init() creates the input force-feedback device with input_ff_create(), then allocates the HID++ FF private data, effect ID array, and workqueue. If any of those allocations fail after input_ff_create() succeeds, the function returns an error without destroying the FF device. Add an unwind path that frees the private allocations made by hidpp_ff_init() and calls input_ff_destroy() for failures after input_ff_create() succeeds.

Affected packages

Ecosystem Package Introduced Fixed