CVE-2026-80780

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: pidff: fix OOB write when hid->inputs is empty

hid_pidff_init_with_quirks() derives its input_dev from

list_entry(hid->inputs.next, struct hid_input, list)

without first checking that hid->inputs is non-empty. The list member

of struct hid_input is at offset 0, so on an empty list list_entry()

yields &hid->inputs itself and the following hidinput->input load reads

an unrelated member of struct hid_device. dev is then a type-confused

pointer, and force-feedback init writes through it: each

set_bit(FF_*, dev->ffbit) stores 8 bytes at dev + 192, past the end of

the object dev actually aliases, and input_ff_create() adds further

writes of a heap pointer and two function pointers.

Until hid-universal-pidff the only caller was hid_pidff_init() from

usbhid, which runs under HID_CLAIMED_INPUT and therefore always has at

least one hid_input. universal_pidff_probe() starts the device with

HID_CONNECT_DEFAULT & ~HID

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References