CVE-2026-31667

A flaw was found in the Linux kernel, specifically within the uinput (user input) and ff-core (force feedback core) modules. A local user, by interacting with a force-feedback gamepad through uinput, can trigger a condition where different parts of the system wait indefinitely for each other to release resources, known as a circular locking dependency. This can lead to a system deadlock, causing the affected system to become unresponsive.

uinput force-feedback and core FF locking had a circular dependency; upstream reorders acquisition to prevent ABBA deadlocks. Red Hat notes impact is local deadlock when combining uinput with FF devices.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the uinput module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.