CVE-2026-90041: Linux Kernel HID Sony Use-After-Free Vulnerability

CVE-2026-90041 Overview

CVE-2026-90041 is a use-after-free vulnerability in the Linux kernel's HID Sony driver. The flaw resides in the sony_input_configured() and sony_probe() probe unwind path. The driver adds controllers to sony_device_list before HID core registers their input devices. When input_register_device() fails after the callback returns, sony_probe() unwinds without removing the stale list entry. The devres-managed sony_sc structure is freed while its list node remains linked. The next matching controller then traverses freed memory, enabling memory corruption on adjacent USB or Bluetooth HID transports.

Critical Impact
An attacker with adjacent network access to a Bluetooth HID transport can trigger memory corruption in the Linux kernel, leading to privilege escalation or denial of service.

Affected Products

Linux kernel HID subsystem (drivers/hid/hid-sony.c)
Systems using Sony PlayStation controllers over USB or Bluetooth HID
Distributions shipping affected stable kernel branches prior to the fix commits

Discovery Timeline

2026-09-16 - CVE-2026-90041 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90041

Vulnerability Analysis

The HID Sony driver manages a global linked list, sony_device_list, used to track connected Sony controllers and coordinate shared resources such as device IDs. During probe, sony_input_configured() inserts the driver-private sony_sc structure into this list before the HID core completes input device registration.

If input_register_device() fails downstream, sony_probe() observes that HID_CLAIMED_INPUT is not set and unwinds the probe. The unwind path only stops the HID hardware; it does not remove the entry from sony_device_list. Because sony_sc is allocated via the device-managed resources (devres) framework, the kernel frees it when the probe returns an error. The list node stored inside sony_sc remains linked to freed memory.

A subsequent probe of another Sony controller walks sony_device_list and dereferences the dangling pointer, producing a classic use-after-free condition.

Root Cause

The root cause is a missing cleanup step on the probe failure path combined with non-idempotent list removal. The driver did not initialize the list node and device ID to inactive states, nor did it run driver-private cleanup on every failure branch. This left the global list holding references to freed devres-managed memory.

Attack Vector

Exploitation requires adjacent network access, consistent with the Bluetooth HID transport used by Sony DualShock and DualSense controllers. An attacker within Bluetooth range can present a crafted HID descriptor that triggers input_register_device() failure during probe. A second controller connection then dereferences the freed sony_sc, giving the attacker a primitive for kernel memory corruption.

The vulnerability is described in prose as no verified public exploit code exists. Refer to the upstream fix commits 3b4709e4864, 7c65699a3a3, and d044d796e2a for the corrected unwind logic.

Detection Methods for CVE-2026-90041

Indicators of Compromise

Kernel oops or panic traces referencing sony_input_configured, sony_probe, or hid-sony following a Bluetooth or USB HID connection event.
KASAN reports flagging use-after-free reads inside sony_device_list traversal.
Repeated HID probe failures followed by kernel instability when new HID devices connect.

Detection Strategies

Enable KASAN in test and staging kernels to catch dangling list traversal during HID probe unwind.
Monitor dmesg and journal logs for input_register_device failures paired with hid-sony messages.
Correlate Bluetooth pairing events with subsequent kernel warnings on endpoints running vulnerable kernels.

Monitoring Recommendations

Collect kernel logs centrally and alert on repeated HID subsystem faults or oops entries.
Track kernel package versions across the fleet to identify hosts running pre-patch stable branches.
Audit systems that expose Bluetooth HID in untrusted environments such as kiosks, conference rooms, and shared workstations.

How to Mitigate CVE-2026-90041

Immediate Actions Required

Apply the stable kernel updates containing commits 3b4709e4864, 7c65699a3a3, and d044d796e2a to all affected Linux systems.
Prioritize patching hosts that use Sony HID controllers or expose Bluetooth HID interfaces.
Reboot systems after patching to ensure the fixed HID Sony module is loaded.

Patch Information

The upstream fix initializes the list node and device ID to inactive states, makes list removal idempotent, and runs driver-private cleanup on every probe failure path. This also permits a second cleanup when sony_input_configured() already unwound a partial initialization. See the commits 3b4709e4864, 7c65699a3a3, and d044d796e2a for the reference implementation.

Workarounds

Blacklist the hid-sony kernel module on systems that do not require Sony controller support until the patch is applied.
Disable Bluetooth on endpoints that do not require wireless HID connectivity.
Restrict physical and radio access to systems that must run vulnerable kernels pending patch deployment.

bash

# Blacklist the hid-sony module until patched
echo 'blacklist hid-sony' | sudo tee /etc/modprobe.d/blacklist-hid-sony.conf
sudo modprobe -r hid_sony 2>/dev/null || true
sudo update-initramfs -u