CVE-2026-23349 HID: pidff: Fix condition effect bit clearing
A NULL pointer dereference in the Linux kernel HID subsystem allows attackers to cause a denial of service via improper clearing of conditional effect bits.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23349?
CVE-2026-23349 is a medium-severity vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: pidff: Fix condition effect bit clearing
As reported by MPDarkGuy on discord, NULL pointer dereferences were happening because not all the conditional effects bits were cleared.
Properly clear all conditional effect bits from ffbit
Weakness: CWE-476
Which versions are affected by CVE-2026-23349?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23349?
Apply the vendor's patch.
Is CVE-2026-23349 being exploited?
There is no known exploitation of CVE-2026-23349 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23349, DEBIAN-CVE-2026-23349, GHSA-c2qc-rj55-83m4, UBUNTU-CVE-2026-23349.