CVE-2026-43049

A flaw was found in the Linux kernel's logitech-hidpp driver. When the force feedback initialization fails for the Logitech G920 Driving Force Racing Wheel, the driver returns an error before properly tearing down userspace infrastructure. This can lead to a use-after-free (UAF) vulnerability if userspace applications continue to access these deallocated resources. A successful exploitation of a UAF flaw could potentially result in a denial of service or arbitrary code execution.

Logitech HID++ force-feedback init failure could leave a UAF; upstream orders teardown safely. Red Hat recommends updates; unload hid_logitech_hidpp where those devices are absent.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the hid_logitech_hidpp module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.