CVE-2026-45969 Overview
CVE-2026-45969 is a Linux kernel vulnerability in the HID PlayStation driver. The ps_gamepad_create() function calls input_ff_create_memless() without verifying its return value. This omission can produce incorrect behavior or kernel crashes when force feedback (FF) effects are triggered on PlayStation gamepad devices. The upstream fix adds a check for the return value of input_ff_create_memless() before further use.
Critical Impact
A failure path in the PlayStation HID driver can result in a kernel-side crash or undefined behavior when force feedback effects are triggered on affected hardware.
Affected Products
- Linux kernel (HID PlayStation driver, hid-playstation)
- Distributions shipping vulnerable mainline and stable kernel branches
- Systems using DualShock and DualSense controllers via the kernel HID stack
Discovery Timeline
- 2026-05-27 - CVE CVE-2026-45969 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45969
Vulnerability Analysis
The defect resides in the ps_gamepad_create() function inside the Linux HID PlayStation driver. The function invokes input_ff_create_memless() to register a memoryless force feedback handler for the gamepad. The original code path does not test the return value of this call. If input_ff_create_memless() fails, for example due to memory allocation failure, the driver continues as if registration succeeded.
When userspace later triggers a force feedback effect on the device, the kernel dereferences state that was never properly initialized. The result is incorrect behavior in the input subsystem, or a kernel oops when FF effect callbacks run against an invalid configuration. The fix, applied across multiple stable branches, captures and propagates the return code so the driver fails cleanly on registration errors.
Root Cause
The root cause is a missing error check on the return value of an internal kernel API. This pattern falls under unchecked return value handling and can manifest as a null pointer dereference or use of uninitialized state when force feedback effects are processed.
Attack Vector
Exploitation requires a PlayStation-class HID device path to the kernel and a force feedback trigger. The realistic impact is local denial of service through a kernel crash when the rare allocation failure path is exercised. The advisory does not document remote exploitation or privilege escalation, and no public proof of concept is referenced in the source data.
No verified exploit code is available. The fix can be reviewed in the upstream commits, including Kernel Git Commit 33acf9a and Kernel Git Commit e680764.
Detection Methods for CVE-2026-45969
Indicators of Compromise
- Kernel oops or panic messages referencing hid-playstation, ps_gamepad_create, or input_ff_create_memless in dmesg and /var/log/kern.log.
- Unexpected disconnects or input subsystem failures when DualShock or DualSense controllers issue rumble or force feedback effects.
Detection Strategies
- Inventory running kernel versions across endpoints and servers and compare them against the fixed commits listed in the upstream stable tree.
- Monitor dmesg ring buffers for HID PlayStation driver warnings, allocation failures near gamepad initialization, and FF-related call traces.
- Correlate kernel crash telemetry with user sessions that include connected gaming peripherals on Linux workstations.
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on call stacks containing ps_gamepad_create or input_ff_* symbols.
- Track kernel package versions through configuration management and flag hosts running unpatched HID PlayStation drivers.
How to Mitigate CVE-2026-45969
Immediate Actions Required
- Apply the latest stable kernel update from your Linux distribution that incorporates the upstream fix.
- For self-built kernels, cherry-pick one of the upstream commits such as 33acf9a4d6eb or e6807641ac94 into the active branch and rebuild.
- Restrict physical and USB access on systems where kernel updates cannot be scheduled immediately.
Patch Information
The fix adds a return value check to input_ff_create_memless() inside ps_gamepad_create(). It has been backported across multiple stable branches. Relevant commits include 33acf9a, 35301ca, 45b01d8, 496a345, 987dee1, d955aeb, and e680764.
Workarounds
- Unload or blacklist the hid_playstation module on systems that do not require PlayStation controller support until a patched kernel is deployed.
- Disable force feedback in applications that interact with the affected controllers to reduce the chance of triggering the faulty code path.
# Blacklist the hid_playstation module until patching is complete
echo "blacklist hid_playstation" | sudo tee /etc/modprobe.d/blacklist-hid-playstation.conf
sudo modprobe -r hid_playstation
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
