CVE-2026-43049: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43049 Overview

CVE-2026-43049 is a use-after-free vulnerability [CWE-416] in the Linux kernel's logitech-hidpp HID driver. The flaw occurs during probing of the Logitech G920 Driving Force Racing Wheel for Xbox One. When force feedback initialisation fails, the driver returns an error before tearing down the userspace infrastructure exposed through sysfs and /dev/input. Userspace processes that ignore the error and continue using their references to these dangling entities trigger a use-after-free condition in kernel memory.

Critical Impact

A local attacker with low privileges can leverage stale references to kernel objects to corrupt memory, potentially achieving privilege escalation or kernel-level code execution.

Affected Products

• Linux Kernel 5.3.9
• Linux Kernel 5.4 (including release candidates rc6, rc7, rc8)
• Linux Kernel 7.0 (release candidates rc1 through rc4)

Discovery Timeline

• 2026-05-01 - CVE-2026-43049 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-43049

Vulnerability Analysis

The vulnerability resides in the hid-logitech-hidpp driver, which manages communication with Logitech HID++ peripherals including the G920 racing wheel. During the probe routine, the driver registers userspace-facing infrastructure such as sysfs attributes and the /dev/input event device before attempting to initialise force feedback support. When force feedback initialisation fails, the probe function returns an error code without unwinding the previously registered userspace interfaces.

Userspace handles to these objects remain valid from the perspective of the calling process, but the underlying kernel structures may be freed or partially deconstructed. Subsequent reads, writes, or ioctl operations against the dangling file descriptors dereference freed kernel memory, producing a classic use-after-free condition.

Root Cause

The root cause is incomplete cleanup on the error path of the probe function. The driver assumed force feedback initialisation occurred before any user-visible registration, but the ordering allowed the device node and sysfs entries to be exposed first. Kernel maintainers chose to convert the failure into a non-fatal warning, leaving the device functional without force feedback rather than attempting to dismantle every component on error.

Attack Vector

Exploitation requires local access and the ability to interact with HID device probing. An attacker who can attach a vulnerable Logitech device, or trigger probe failures programmatically, can keep file descriptors open across the failed initialisation. Once the kernel objects are freed, the attacker writes to /dev/input or sysfs paths to dereference the stale pointers. Successful exploitation leads to memory corruption in kernel context.

No public proof-of-concept exploit is currently available for CVE-2026-43049.

Detection Methods for CVE-2026-43049

Indicators of Compromise

• Kernel log entries referencing logitech-hidpp probe failures, force feedback initialisation warnings, or HID++ subsystem errors immediately preceding crashes.
• Unexpected kernel oops or panic traces involving input_event, sysfs_remove, or HID input device cleanup functions.
• Unusual process activity holding file descriptors against /dev/input/event* nodes for devices that failed to initialise.

Detection Strategies

• Monitor dmesg and journalctl -k output for HID++ driver warnings combined with subsequent input subsystem faults.
• Audit running kernel versions across the fleet against the patched commits to identify exposed hosts.
• Correlate USB device attachment events with kernel error messages to detect potential exploitation attempts.

Monitoring Recommendations

• Enable KASAN (Kernel Address Sanitizer) on test systems to surface use-after-free conditions during driver probe sequences.
• Forward kernel ring buffer logs to a centralised logging platform for retention and pattern analysis.
• Track HID device attachment events through udev and audit subsystems to flag anomalous peripheral activity on sensitive hosts.

How to Mitigate CVE-2026-43049

Immediate Actions Required

• Apply the upstream stable kernel patches that resolve the cleanup ordering in hid-logitech-hidpp.
• Inventory systems running affected kernel versions, prioritising workstations and servers where untrusted users can attach USB devices.
• Restrict physical and logical USB access on multi-user hosts until patches are deployed.

Patch Information

The Linux kernel maintainers resolved the issue by treating force feedback initialisation failure as a warning while keeping the device functional. The fix is available in the following stable kernel commits: 772f99cc8d6e, 9a793ac19eb8, b846fb0a73e9, and f7a4c78bfeb3. Distribution vendors typically backport these patches to supported kernel branches.

Workarounds

• Blacklist the hid_logitech_hidpp module on systems that do not require Logitech HID++ peripherals using modprobe.d configuration.
• Apply USB device access policies through udev rules to restrict which users can attach HID devices.
• Use USBGuard or equivalent allow-list tooling to block unauthorised peripheral attachment on sensitive endpoints.

# Blacklist the vulnerable driver until kernel is patched
echo "blacklist hid_logitech_hidpp" | sudo tee /etc/modprobe.d/blacklist-hidpp.conf
sudo update-initramfs -u

# Verify the running kernel version against patched commits
uname -r