CVE-2026-80771 HID: nintendo: register input device after capabilities are set
A race condition in the Linux kernel Nintendo HID driver allows local attackers to cause a denial of service via NULL pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80771?
CVE-2026-80771 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: nintendo: register input device after capabilities are set
input_register_device() exposes the device to userspace immediately. In joycon_input_create() it was called before joycon_config_rumble() configures the FF_RUMBLE capability and the memless force-feedback device, so a concurrent EVIOCSFF could dereference a NULL dev->ff.
Registering early also means the initial udev event lacks button and axis information, which can make input managers ignore the device.
Move input_register_device() to the end of joycon_input_create(), after all capabilities, the IMU input device and the force-feedback callbacks have been configured.
Which versions are affected by CVE-2026-80771?
How do I fix CVE-2026-80771?
Apply the vendor's patch.
Is CVE-2026-80771 being exploited?
There is no known exploitation of CVE-2026-80771 in the wild and no public exploit code.
Sources
Also known as AZL-99624, BELL-CVE-2026-80771, DEBIAN-CVE-2026-80771, GHSA-x6pf-56pg-q32p, UBUNTU-CVE-2026-80771.