CVE-2026-23349: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23349 is a NULL pointer dereference vulnerability in the Linux kernel's HID pidff (Physical Interface Device force feedback) driver, caused by incomplete clearing of conditional effect bits. Discovered and disclosed on March 25, 2026, it affects Linux kernel versions 6.18.1 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1 through 7.0-rc7. The issue was originally reported by a user (MPDarkGuy) via Discord. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access with low privileges (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-476 (NULL Pointer Dereference) and CWE-824 (Access of Uninitialized Pointer). In the pidff HID driver, not all conditional effect bits were being cleared from the ffbit bitmask when processing force feedback effects, leaving some pointers uninitialized. When the driver subsequently attempted to dereference these uninitialized pointers during conditional effect handling, a NULL pointer dereference occurred. Exploitation requires local system access and interaction with a HID force feedback device using the pidff driver (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation allows a local low-privilege user to trigger a kernel NULL pointer dereference, resulting in a kernel crash or system hang — a denial of service condition. There is no impact on confidentiality or data integrity, and code execution is not possible through this vulnerability. The scope is limited to the local system; lateral movement and data exfiltration are not applicable (Red Hat Advisory).

Patches are available in Linux kernel versions 6.18.17, 6.19.7, and 7.0-rc3 (and later releases), which properly clear all conditional effect bits in the pidff driver (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3). Administrators should apply the relevant kernel security updates as soon as possible. As a temporary workaround for systems that cannot be patched immediately, restrict local user access and disable HID force feedback functionality if it is not operationally required.