CVE-2026-90041

A flaw was found in the Linux kernel's Human Interface Device (HID) Sony driver. When a device fails to initialize, the driver does not correctly remove the device from its internal list, leading to a use-after-free vulnerability. This allows a local attacker to potentially cause a system crash or denial of service by interacting with the affected driver.

A use after free in the HID sony driver can occur when sony_input_configured links a controller into sony_device_list before HID input registration is fully completed. If input_register_device later fails, sony_probe can unwind without removing the driver private list entry, and the devres managed sony_sc object can be freed while its list node remains reachable. A subsequent matching Sony controller can traverse freed memory through the stale list entry, which can lead to a kernel crash and may create a memory corruption primitive depending on heap reuse. For the CVSS the PR:N is used because a malicious or faulty HID controller can reach the probe path without an attacker having an account on the victim system, although physical USB access or Bluetooth proximity and pairing are usually required. The issue is not remotely reachable over IP networks. Impact is at least denial of service and in the paranoid case may include confidentiality or integrity impact because the stale global list pointer is a UAF candidate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.