PT-2026-94677

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the HID subsystem. The hid device io start function allows reports to run concurrently with the probe process. If the probe fails, the hid device probe...

CVE-2026-90328: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-90197: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: haptic: don't write an uninitialized value to unhandled usages filleffectbuf initializes value only for the four haptic usages handled by its switch, but writes it to field-value for every usage. An unhandled usage can...

CVE-2026-93188: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index konekeepvaluesuptodate and koneprofileactivated use an 8-bit, device-supplied profile value as an index into the 5-element kone-profiles array without a range check. A malicious US...

CVE-2026-90331: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid-asus driver: - unchecked size in asusrawevent - unclean teardown of asusprobe on failure - possible use-after-free in asuspro...

PT-2026-94679

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Multiple issues exist within the hid-asus driver. These include an unchecked size in the asus raw event function, an unclean teardown of asus probe upon failure, and a possible...

PT-2026-94545

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the HID haptic subsystem where the fill effect buf function initializes values only for four specific haptic usages. However, it writes these values to field-value for...

PT-2026-94676

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the HID steam driver where Steam Controller FEATURE reports encode the message size within the message itself. The system previously trusted that the reported size...

PT-2026-94985

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the HID core. When a driver's probe process calls hid device io start to enable input delivery but subsequently fails during initialization, it unwinds v...

AZL-101606 CVE-2026-90041 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list on probe failure sonyinputconfigured adds some controllers to sonydevicelist before HID core registers their input devices. inputregisterdevice can fail after the callback returns successfully...

DEBIAN-CVE-2026-90041

In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list on probe failure sonyinputconfigured adds some controllers to sonydevicelist before HID core registers their input devices. inputregisterdevice can fail after the callback returns successfully...

AZL-101123 CVE-2026-90000 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-90000

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

DEBIAN-CVE-2026-90000

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-90001

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

EUVD-2026-80649

In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list on probe failure sonyinputconfigured adds some controllers to sonydevicelist before HID core registers their input devices. inputregisterdevice can fail after the callback returns successfully...

CVE-2026-90041

CVE-2026-90041 is a use-after-free vulnerability in the Linux kernel's HID Sony driver (hid-sony). When input_register_device() fails after sony_input_configured() has already linked a controller to sony_device_list, the probe unwind path frees the devres-managed sony_sc structure while its list ...

EUVD-2026-80609

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-90001 HID: bpf: serialize device reference release in struct_ops destroy path

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-90001

A race condition in the Linux kernel HID BPF subsystem allows __hid_bpf_ops_destroy_device() and hid_bpf_unreg() to double-put the struct hid_device reference, freeing the device while hid_destroy_device() is still using it. The root cause is a TOCTOU flaw: the two paths run under different lock ...