{"id":"CVE-2026-80770","summary":"HID: nintendo: stop device IO before hid_hw_stop on probe failure","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: nintendo: stop device IO before hid_hw_stop on probe failure\n\nnintendo_hid_probe() calls hid_device_io_start() before joycon_init()\nand joycon_leds_create().  If either fails, the error path jumps to\nerr_close which calls hid_hw_close()/hid_hw_stop() without first calling\nhid_device_io_stop().\n\nhid_hw_stop() does not stop device IO, so hid_input_report() may still\nrun and access driver data that is being torn down, resulting in a\nuse-after-free.\n\nAdd an err_io_stop label that calls hid_device_io_stop() before\nhid_hw_close(), and point the two post-io_start error paths at it.","modified":"2026-09-06T03:46:43.861682606Z","published":"2026-09-04T15:12:42.327Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80770.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/03a84f9f88b42cd49752ec0259922b67e4b88598"},{"type":"WEB","url":"https://git.kernel.org/stable/c/13a3edf96568a0b7aacadea07c2adec53ac8f630"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1f74d3bff6fe04a64e02ab3661d2e0d554565aa6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2e0d98dc8a6dea5fc2b72bf66e0dcbd5488644b4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5efcd7bbfaaec67d137c99aa0940fa34375db27f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c023443f0e6cfd257846b6515c93c1ea08026593"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c2f3d51c7f5222f5b51e0c90f02258d82e1b44dd"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80770.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80770"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2af16c1f846bd60240745bbd3afa13d5f040c61a"},{"fixed":"c2f3d51c7f5222f5b51e0c90f02258d82e1b44dd"},{"fixed":"c023443f0e6cfd257846b6515c93c1ea08026593"},{"fixed":"03a84f9f88b42cd49752ec0259922b67e4b88598"},{"fixed":"5efcd7bbfaaec67d137c99aa0940fa34375db27f"},{"fixed":"13a3edf96568a0b7aacadea07c2adec53ac8f630"},{"fixed":"2e0d98dc8a6dea5fc2b72bf66e0dcbd5488644b4"},{"fixed":"1f74d3bff6fe04a64e02ab3661d2e0d554565aa6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80770.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.187"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.156"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.106"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.47"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0"},{"fixed":"7.2.1"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80770.json"}}],"schema_version":"1.9.0"}