CVE-2026-93826 (GCVE-0-2026-93826)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:03 – Updated: 2026-09-25 12:43
VLAI
Title
HID: hidpp: fix potential UAF in hidpp_connect_event()
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidpp_connect_event() If input_register_device() fails, we call input_free_device(), but keep stale pointer to the old device in hidpp->input, which could potentially lead to UAF. Fix that by resetting it to NULL before returning from hidpp_connect_event().
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c39e3d5fc9dd3e16c6f59dd94d827540040de66d , < 3b8b2e58b078cd30e121401535541bb8a6d57133 (git)
Affected: c39e3d5fc9dd3e16c6f59dd94d827540040de66d , < 3303398cc2aa255ba251650a30024e11d48ea6c3 (git)
Affected: c39e3d5fc9dd3e16c6f59dd94d827540040de66d , < 6df6b1f2c49678211f65647c300bc51dda02893b (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-logitech-hidpp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b8b2e58b078cd30e121401535541bb8a6d57133",
              "status": "affected",
              "version": "c39e3d5fc9dd3e16c6f59dd94d827540040de66d",
              "versionType": "git"
            },
            {
              "lessThan": "3303398cc2aa255ba251650a30024e11d48ea6c3",
              "status": "affected",
              "version": "c39e3d5fc9dd3e16c6f59dd94d827540040de66d",
              "versionType": "git"
            },
            {
              "lessThan": "6df6b1f2c49678211f65647c300bc51dda02893b",
              "status": "affected",
              "version": "c39e3d5fc9dd3e16c6f59dd94d827540040de66d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-logitech-hidpp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hidpp: fix potential UAF in hidpp_connect_event()\n\nIf input_register_device() fails, we call input_free_device(), but keep\nstale pointer to the old device in hidpp-\u003einput, which could potentially\nlead to UAF. Fix that by resetting it to NULL before returning from\nhidpp_connect_event()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The UAF is in hidpp_connect_event(), reached from hidpp_probe() and from hidpp_raw_hidpp_event() on a HID++ short report with rap.sub_id 0x41. DELAYED_INIT devices are Unifying DJ children (PIDs 0x4011/0x4101/0x402d via logi_dj_recv_add_djhid_device) and Bluetooth T651, so the trigger arrives over Unifying 2.4 GHz or Bluetooth HIDP.\nAC:H - The dangling hidpp-\u003einput is created only when hidpp_populate_input() stores the new device and input_register_device() then fails, so hidpp_connect_event() calls input_free_device() without clearing the pointer. That register fails on GFP_KERNEL ENOMEM (devres_alloc/input_device_tune_vals), device_add(), or -EINTR on input_mutex, which a HID++ peer cannot induce on demand.\nPR:N - logi_dj_raw_event() delivers Unifying pairing/connect notifications and HID++ reports to the child with no host credential check, and hidpp_probe() binds logitech-hidpp-device during that enumeration; Bluetooth T651 HIDP bind is likewise unauthenticated. No OS account or capability is required.\nUI:N - A REPORT_TYPE_NOTIF_DEVICE_PAIRED/CONNECTED notification (or T651 HIDP connect) runs hidpp_probe() which schedules hidpp_connect_event(); after the failed register, later HID reports handled by wtp_raw_event()/m560_raw_event() dereference hidpp-\u003einput. The attacker\u0027s peripheral generates both without a victim mount, click, or prompt.\nS:U - The freed object is the delayed struct input_dev allocated by hidpp_allocate_input() and stored in hidpp-\u003einput; the UAF stays inside the host kernel HID/input authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After input_free_device(), wtp_raw_event()/m560_raw_event() still see a non-NULL hidpp-\u003einput and call input_mt_get_slot_by_key()/input_event()/input_sync() on the freed input_dev (vals, absinfo, mt slots). UAF of that heap object is an arbitrary-read primitive once the slab is reused.\nI:H - The same dangling hidpp-\u003einput is used for input_mt_slot(), input_report_key/rel(), and input_sync(), which write event state and walk handlers on the freed input_dev; heap spray of that object yields arbitrary kernel writes and control-flow hijack.\nA:H - Dereferencing the freed input_dev in wtp_touch_event()/m560_raw_event() after hidpp_connect_event()\u0027s input_free_device() oopses or panics when the object is not reused; hidpp_probe() still succeeds, and DJ\u0027s no-op logi_dj_ll_close() keeps delivering reports that retrigger the crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:43:35.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b8b2e58b078cd30e121401535541bb8a6d57133"
        },
        {
          "url": "https://git.kernel.org/stable/c/3303398cc2aa255ba251650a30024e11d48ea6c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/6df6b1f2c49678211f65647c300bc51dda02893b"
        }
      ],
      "title": "HID: hidpp: fix potential UAF in hidpp_connect_event()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93826",
    "datePublished": "2026-09-24T16:03:04.711Z",
    "dateReserved": "2026-09-18T17:59:28.792Z",
    "dateUpdated": "2026-09-25T12:43:35.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93826",
      "date": "2026-09-25",
      "epss": "0.0022",
      "percentile": "0.11247"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/hid-logitech-hidpp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3b8b2e58b078cd30e121401535541bb8a6d57133",
                    "status": "affected",
                    "version": "c39e3d5fc9dd3e16c6f59dd94d827540040de66d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3303398cc2aa255ba251650a30024e11d48ea6c3",
                    "status": "affected",
                    "version": "c39e3d5fc9dd3e16c6f59dd94d827540040de66d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6df6b1f2c49678211f65647c300bc51dda02893b",
                    "status": "affected",
                    "version": "c39e3d5fc9dd3e16c6f59dd94d827540040de66d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/hid-logitech-hidpp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.19"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hidpp: fix potential UAF in hidpp_connect_event()\n\nIf input_register_device() fails, we call input_free_device(), but keep\nstale pointer to the old device in hidpp-\u003einput, which could potentially\nlead to UAF. Fix that by resetting it to NULL before returning from\nhidpp_connect_event()."
          }
        ],
        "id": "CVE-2026-93826",
        "lastModified": "2026-09-25T13:17:23.403",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T17:17:16.297",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3303398cc2aa255ba251650a30024e11d48ea6c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3b8b2e58b078cd30e121401535541bb8a6d57133"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6df6b1f2c49678211f65647c300bc51dda02893b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.