What’s Vulnerable › Vulnerabilities

CVE-2026-90330: HID: logitech-hidpp: Fix FF device cleanup on init failure

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix FF device cleanup on init failure hidpp_ff_init() creates the input force-feedback device with input_ff_create(), then allocates the HID++ FF private data, effect ID array, and workqueue. If any of those allocations fail after input_ff_create() succeeds, the function returns an error without destroying the FF device. Add an unwind path that frees the private allocations made by hidpp_ff_init() and calls input_ff_destroy() for failures after input_ff_create() succeeds.

Affected products

• Linux: 4.6 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/13378c9ac0a1bcdf49ba158e4199594aafb589cd
• https://git.kernel.org/stable/c/2fd9c8112907c14efefe6a90d20b774737052db3
• https://git.kernel.org/stable/c/360a49fc53acdfe2dbb80c23cfa606ed7e13a85d
• https://git.kernel.org/stable/c/6bb216586a3cb4ce327511a7c0445fa88e85b3cb
• https://git.kernel.org/stable/c/a265fee3d24bd611783fd929582b7b6d62000a65
• https://git.kernel.org/stable/c/dd5be4d9ce2dfc4d4a4527ef7d31d21a78e3cdac

Get alerted when CVE-2026-90330 or the next vulnerability affects your stack