CVE-2026-80770: Linux Kernel HID Nintendo Use-After-Free

CVE-2026-80770 Overview

CVE-2026-80770 is a use-after-free vulnerability in the Linux kernel's HID Nintendo driver (hid-nintendo), which handles Nintendo Switch Joy-Con and Pro Controller devices. The flaw resides in the nintendo_hid_probe() function, which calls hid_device_io_start() before joycon_init() and joycon_leds_create(). If either initialization routine fails, the error path jumps to err_close and calls hid_hw_close() and hid_hw_stop() without first invoking hid_device_io_stop(). Because hid_hw_stop() does not halt device I/O, hid_input_report() may still execute and access driver data that is being torn down.

Critical Impact
A failed probe of a Nintendo HID device can trigger a use-after-free in the kernel, potentially leading to memory corruption or local privilege escalation on affected Linux systems.

Affected Products

Linux kernel builds containing the hid-nintendo driver prior to the fix
Distributions shipping the vulnerable driver across multiple stable branches referenced in the upstream patches
Systems that expose USB or Bluetooth HID interfaces to Nintendo Joy-Con or Pro Controller devices

Discovery Timeline

2026-09-04 - CVE-2026-80770 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80770

Vulnerability Analysis

The defect is a use-after-free [CWE-416] triggered during probe failure of the hid-nintendo driver. Once hid_device_io_start() enables asynchronous input processing, the HID core may deliver reports to hid_input_report() at any time. If joycon_init() or joycon_leds_create() subsequently fails, the driver enters its cleanup path and begins freeing per-device state. The cleanup path calls hid_hw_close() and hid_hw_stop(), neither of which quiesces in-flight input reports.

The result is a race between the driver tear-down and concurrent report callbacks. A report handler can dereference driver state that has already been released, producing memory corruption. Because the driver runs in kernel context, exploitation of the resulting use-after-free may allow an attacker with control over a HID device to escalate privileges or destabilize the kernel.

Root Cause

The root cause is missing symmetry between hid_device_io_start() and hid_device_io_stop() on the probe error path. Once I/O is started, any subsequent failure must stop I/O before releasing driver-owned data. The original code omitted hid_device_io_stop() before hid_hw_close(), leaving a window in which hid_input_report() could operate on freed memory.

Attack Vector

Exploitation requires the ability to attach a Nintendo-class HID device, physically over USB or over Bluetooth, and to cause joycon_init() or joycon_leds_create() to fail. A crafted or malfunctioning peripheral that returns unexpected responses during initialization can drive the failure path while simultaneously emitting input reports, racing the cleanup routine.

No public exploit or proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The upstream fix introduces an err_io_stop label that calls hid_device_io_stop() before hid_hw_close() and redirects both post-io_start error paths to it. See the upstream kernel commit for the patch.

Detection Methods for CVE-2026-80770

Indicators of Compromise

Kernel oops or panic messages referencing hid_input_report, joycon_, or hid-nintendo in dmesg or journalctl -k
KASAN use-after-free reports naming Nintendo HID driver symbols on kernels built with sanitizers enabled
Repeated probe failures for Nintendo Joy-Con or Pro Controller devices immediately followed by kernel warnings

Detection Strategies

Inventory running kernel versions against the fixed commits listed in the kernel.org stable tree to identify hosts still exposed
Enable KASAN on test builds to catch use-after-free reports during HID device attach and disconnect scenarios
Monitor kernel logs for HID subsystem errors correlated with USB or Bluetooth HID hot-plug events

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on hid-nintendo probe failures
Track USB and Bluetooth HID device attachment events on multi-user or shared workstations
Correlate device attach events with subsequent kernel warnings to identify anomalous peripherals

How to Mitigate CVE-2026-80770

Immediate Actions Required

Update the Linux kernel to a version that includes the err_io_stop fix from the referenced stable commits
Rebuild and redeploy custom kernels that carry the hid-nintendo driver to include the patch
Restrict physical and Bluetooth pairing access on shared or kiosk systems where untrusted HID devices could be attached

Patch Information

The fix has been merged across multiple stable branches. Refer to the upstream commits: 03a84f9, 13a3edf, 1f74d3b, 2e0d98d, 5efcd7b, c023443, and c2f3d51. Apply the vendor kernel package that incorporates the corresponding backport.

Workarounds

Blacklist the hid-nintendo module on systems that do not require Joy-Con or Pro Controller support using modprobe configuration
Disable Bluetooth HID pairing on servers and unattended endpoints to prevent untrusted peripheral attachment
Enforce USB port controls or endpoint policies that limit which HID device classes may bind on sensitive hosts

bash

# Blacklist the vulnerable driver until the kernel is patched
echo 'blacklist hid-nintendo' | sudo tee /etc/modprobe.d/blacklist-hid-nintendo.conf
sudo depmod -a
sudo update-initramfs -u