CVE-2026-80771: Linux Kernel HID Nintendo Privilege Escalation

CVE-2026-80771 Overview

CVE-2026-80771 is a race condition in the Linux kernel's HID Nintendo driver (hid-nintendo). The joycon_input_create() function called input_register_device() before joycon_config_rumble() configured the FF_RUMBLE capability and the memless force-feedback device. Because input_register_device() exposes the device to userspace immediately, a concurrent EVIOCSFF ioctl could dereference a NULL dev->ff pointer. The early registration also caused the initial udev event to lack button and axis information, which could make input managers ignore the device.

Critical Impact
A local user with access to the Joy-Con input device can trigger a NULL pointer dereference by issuing a force-feedback ioctl during the registration window, causing a kernel crash and local denial of service.

Affected Products

Linux kernel versions containing the hid-nintendo driver prior to the fix commits
Systems using Nintendo Joy-Con or Pro Controller devices over HID
Distributions shipping the vulnerable HID Nintendo driver

Discovery Timeline

2026-09-04 - CVE-2026-80771 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80771

Vulnerability Analysis

The flaw is a race condition between input device registration and force-feedback configuration in the hid-nintendo driver. When joycon_input_create() calls input_register_device(), the kernel immediately exposes the device node under /dev/input/ and emits a udev event. Userspace can open that node and issue ioctls before the driver finishes configuring optional subsystems.

In the vulnerable ordering, joycon_config_rumble() runs after registration. That function sets the FF_RUMBLE capability bit and initializes the memless force-feedback structure at dev->ff. A userspace process that opens the device and issues an EVIOCSFF ioctl during this window follows the force-feedback code path, which dereferences dev->ff without checking whether initialization completed.

Root Cause

The root cause is ordering of initialization steps in joycon_input_create(). The driver published the input device to userspace before finalizing capability bits, the IMU input device, and the force-feedback callbacks. This violates the invariant that input_register_device() must be the final step of device setup.

Attack Vector

Exploitation requires local access to the input device and the ability to issue ioctls against it. An unprivileged process can loop opening the newly created input node and calling EVIOCSFF to win the race. Successful exploitation produces a NULL pointer dereference in kernel context, resulting in an oops and local denial of service. The upstream fix moves input_register_device() to the end of joycon_input_create() after all capabilities, the IMU input device, and the force-feedback callbacks are configured. See the Linux Kernel Commit 268679f for the patch.

Detection Methods for CVE-2026-80771

Indicators of Compromise

Kernel oops messages referencing joycon_input_create, input_ff_upload, or a NULL pointer dereference in the input force-feedback path
Repeated EVIOCSFF ioctls issued against a freshly enumerated hid-nintendo input device
Unexpected crashes or reboots on systems where Joy-Con or Pro Controller devices are connected

Detection Strategies

Compare running kernel versions against the fixed stable branches referenced in the commits 268679f, 27dc4b8, 3288bec, a9fc754, and d723bc1
Monitor dmesg and journal logs for HID Nintendo driver warnings correlated with input subsystem faults
Audit workstations and kiosks that expose HID game controllers to untrusted local users

Monitoring Recommendations

Ingest kernel logs into a centralized logging pipeline and alert on NULL pointer dereferences within HID or input subsystem stack traces
Track udev events for hid-nintendo device creation followed by immediate ioctl activity from unexpected processes
Baseline expected controller usage and flag processes that repeatedly reopen input nodes

How to Mitigate CVE-2026-80771

Immediate Actions Required

Update to a Linux kernel release that includes the fix commits 268679f, 27dc4b8, 3288bec, a9fc754, or d723bc1
Restrict local access on systems where the hid-nintendo driver is loaded and untrusted users could interact with input devices
Verify distribution vendor advisories for backported patches to long-term support kernels

Patch Information

The upstream fix moves input_register_device() to the end of joycon_input_create() so that FF_RUMBLE, the IMU input device, and the force-feedback callbacks are configured before userspace can access the device. Apply the fix from any of the following stable commits: 268679f, 27dc4b8, 3288bec, a9fc754, and d723bc1.

Workarounds

Blacklist the hid-nintendo kernel module on systems that do not require Joy-Con or Pro Controller support
Apply udev rules that restrict access to Nintendo HID input device nodes to trusted users or groups
Avoid attaching Joy-Con or Pro Controller devices to shared multi-user systems until patched kernels are deployed

bash

# Blacklist the vulnerable driver until the kernel is patched
echo 'blacklist hid-nintendo' | sudo tee /etc/modprobe.d/blacklist-hid-nintendo.conf
sudo update-initramfs -u