CVE-2026-90041 HID: sony: clean up device list on probe failure
A use-after-free vulnerability in the Linux kernel's Sony HID driver allows attackers to cause memory corruption or system crashes via specific device probe failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90041?
CVE-2026-90041 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: sony: clean up device list on probe failure
sony_input_configured() adds some controllers to sony_device_list before HID core registers their input devices. input_register_device() can fail after the callback returns successfully. sony_probe() then observes that HID_CLAIMED_INPUT is clear and unwinds, but only stops the HID hardware. The devres-managed sony_sc is freed while its list node remains linked, so the next matching controller traverses freed memory.
Initialize the list node and device ID to inactive states. Make list removal idempotent and run the driver-private cleanup on every probe failure path. This also makes a second cleanup safe when sony_input_configured() already unwound a partial initialization before sony_probe() handles the missing input claim.
Found by 0sec (https://0sec.ai) using automated source analysis; verified against the HID input registration and probe unwind paths.
Which versions are affected by CVE-2026-90041?
How do I fix CVE-2026-90041?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90041 being exploited?
There is no known exploitation of CVE-2026-90041 in the wild and no public exploit code.
Sources
Also known as AZL-101606, BELL-CVE-2026-90041, DEBIAN-CVE-2026-90041, GHSA-qh4f-62fc-9qxv, UBUNTU-CVE-2026-90041.