CVE-2026-43152: Linux Kernel Privilege Escalation Flaw

CVE-2026-43152 Overview

CVE-2026-43152 is a null pointer dereference vulnerability in the Linux kernel's hid-pl driver, which supports PantherLord and GreenAsia force feedback devices. The driver fails to propagate errors from its probe routine, so initialization failures go unreported. When a user later triggers force feedback (FF) functionality, the kernel dereferences a NULL pointer that was never initialized.

The issue resides in the Human Interface Device (HID) subsystem and is triggered through normal use of an affected input device. The fix ensures that probe errors are returned to the caller so the FF code path is not exercised on a partially initialized device.

Critical Impact
A NULL pointer dereference in hid-pl causes a kernel oops the first time force feedback is invoked on a device whose initialization silently failed.

Affected Products

Linux kernel — hid-pl driver (PantherLord/GreenAsia HID force feedback)
Multiple stable branches as referenced by upstream commits
Distributions shipping the unpatched hid-pl driver

Discovery Timeline

2026-05-06 - CVE-2026-43152 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43152

Vulnerability Analysis

The hid-pl driver registers force feedback support during device probe. The original probe logic ignored failures from internal initialization helpers and still allowed the device to attach. The FF state structure that should have been allocated during init was therefore left as a NULL pointer in the device context.

When userspace later issued an FF command (for example, through the evdev interface to play a rumble effect), the driver dereferenced the uninitialized pointer. The result is a kernel NULL pointer dereference, producing an oops and a denial of service on the affected CPU context. The classification aligns with [CWE-476] Null Pointer Dereference inside a kernel driver.

Root Cause

The root cause is missing error propagation in the probe path of hid-pl. The probe function called initialization routines whose return codes were discarded, allowing the driver to continue binding to the device after an allocation or registration failure. Because the FF private data was never set, any subsequent FF operation operated on a NULL pointer.

Attack Vector

Exploitation requires a user-triggerable code path that invokes force feedback on a hid-pl controlled device. In practice this means a local user with access to the input device, or a physically attached USB HID device that matches the driver's ID table. The outcome is a kernel crash rather than code execution, so the vulnerability is a local denial-of-service issue. There are no known public exploits and the vulnerability is not listed in CISA KEV. The EPSS probability is 0.024%.

No verified exploit code is available for this issue. See the upstream commits referenced below for the precise code change.

Detection Methods for CVE-2026-43152

Indicators of Compromise

Kernel oops messages referencing hid-pl or hid_plff_play in the call trace within dmesg or /var/log/kern.log.
Repeated input subsystem failures correlated with attaching PantherLord or GreenAsia HID devices.
Unexpected process kills or session terminations following force feedback activity in games or test tools.

Detection Strategies

Inventory running kernels and compare against the fixed versions identified by the upstream stable commits listed in the references.
Audit loaded modules with lsmod | grep hid_pl and verify the package version of the kernel providing the module.
Correlate kernel crash telemetry with HID device hot-plug events to identify probe-time failures.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on BUG: kernel NULL pointer dereference entries that include hid-pl frames.
Monitor unscheduled reboots and kernel panic counters on endpoints that connect third-party USB game controllers.
Track kernel package versions across the fleet and flag hosts that lag behind the patched stable releases.

How to Mitigate CVE-2026-43152

Immediate Actions Required

Update the Linux kernel to a stable release that includes the HID: hid-pl: handle probe errors fix referenced by the upstream commits.
Reboot affected hosts after upgrading so the patched hid-pl module is loaded.
Restrict physical and USB access on systems where kernel patching is delayed.

Patch Information

The fix is published in the Linux stable tree across multiple branches. See Linux Kernel Commit 04e50f4, Linux Kernel Commit 1d46d07, Linux Kernel Commit 3756a27, Linux Kernel Commit 4490044, Linux Kernel Commit 78df3de, Linux Kernel Commit 7d2f4fd, Linux Kernel Commit 8a84149, and Linux Kernel Commit 926e671. Apply the kernel update provided by your distribution maintainer.

Workarounds

Blacklist the hid-pl module on systems that do not require PantherLord or GreenAsia HID force feedback support.
Disable or unplug affected HID gamepads until the kernel is patched.
Limit local user access to /dev/input/event* nodes so untrusted users cannot trigger force feedback operations.

bash

# Prevent hid-pl from loading until the kernel is patched
echo 'blacklist hid_pl' | sudo tee /etc/modprobe.d/blacklist-hid-pl.conf
sudo rmmod hid_pl 2>/dev/null || true
sudo update-initramfs -u