CVE-2026-80780

A flaw was found in the Linux kernel's Human Interface Device (HID) pidff driver. A remote attacker, by plugging in a specially crafted malicious USB device, can trigger an out-of-bounds write in the hid_pidff_init_with_quirks() function. This occurs because the function fails to validate if the input list is empty before processing, leading to memory corruption. This vulnerability can result in a denial of service or potentially arbitrary code execution, without requiring any user interaction or additional software.

A flaw was found in the Linux kernel HID pidff force-feedback driver, which Red Hat rates as IMPORTANT. When a USB HID device's report descriptor contains only a PID (Physical Interface Device) application collection, the hid_pidff_init_with_quirks() function can derive its input_dev pointer from an empty hid->inputs list, producing a type-confused pointer through which force-feedback initialization performs out-of-bounds writes and corrupts kernel memory. Simply plugging a specially crafted malicious USB device into an affected system is enough to trigger the write in the USB probe path: no prior privileges, user interaction, or attacker software is required, and the resulting memory corruption can crash the kernel or potentially lead to arbitrary code execution. Red Hat Enterprise Linux 7, 8, and 9 (including the real-time kernels and z-streams), RHEL 10.0.z, and OpenShift Container Platform are not affected because the vulnerable code is not present in those kernels. The affected RHEL 10 and Red Hat In-Vehicle OS kernel streams do carry the vulnerable code; fixes are being pursued through the owning teams for those streams, although for certain delegated RHEL 10 streams the fix is currently marked wontfix, leaving the residual risk that physical insertion of a malicious USB HID device could corrupt kernel memory on those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.