CVE-2026-90041: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-90041 is a use-after-free vulnerability in the Linux kernel's HID sony driver (drivers/hid/hid-sony.c) that can allow a local attacker to execute arbitrary code with kernel privileges or crash the system. The flaw exists because sony_input_configured() adds controllers to sony_device_list before HID core completes input device registration; if input_register_device() subsequently fails, the devres-managed sony_sc structure is freed while its list node remains linked, enabling the next controller probe to traverse freed memory. The vulnerability was introduced in kernel version 4.10 and affects Linux kernel versions from 4.10 up to (but not including) the fixed commits. It was discovered by 0sec using automated source analysis and disclosed on September 16, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is a use-after-free (CWE-416) condition in the Linux kernel HID sony driver's probe and cleanup logic. Specifically, sony_input_configured() appends a controller's sony_sc structure to the global sony_device_list before input_register_device() is called by HID core. If input_register_device() fails after the callback returns, sony_probe() detects that HID_CLAIMED_INPUT is not set and begins unwinding — but only stops the HID hardware without removing the list node. The devres framework then frees sony_sc, leaving a dangling pointer in sony_device_list; the next controller probe that iterates this list will access freed kernel memory. The fix initializes list nodes and device IDs to inactive states, makes list removal idempotent, and ensures driver-private cleanup runs on all probe failure paths (GitHub Advisory).

Successful exploitation allows a local user with the ability to attach or probe Sony HID controllers (e.g., DualShock, DualSense) to trigger a use-after-free in kernel memory, potentially enabling arbitrary code execution at kernel privilege level or causing a kernel panic (denial of service). The confidentiality, integrity, and availability impacts are all rated High, as kernel-level code execution could expose all data on the system, allow modification of kernel structures, and crash the host. Lateral movement within a multi-tenant or containerized environment may be possible if kernel privileges are obtained (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The EPSS score is 0.0, reflecting a very low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to attach or trigger probing of a Sony HID device, limiting the practical attack surface.

1. Gain local access: Obtain a local user session on a vulnerable Linux system (kernel 4.10 through the unpatched versions) with the ability to attach USB or Bluetooth HID devices.
2. Attach a Sony HID controller: Connect a Sony HID-compatible controller (e.g., DualShock 3/4, DualSense) to the target system, triggering the sony_probe() and sony_input_configured() code paths.
3. Trigger probe failure: Engineer or wait for a condition where input_register_device() fails after sony_input_configured() has already added the device to sony_device_list (e.g., by exhausting input device slots or manipulating device registration timing).
4. Exploit use-after-free: After sony_sc is freed by devres but its list node remains linked, attach a second matching Sony controller to cause the kernel to traverse the freed sony_device_list entry, enabling controlled memory corruption.
5. Achieve kernel code execution: Leverage the use-after-free primitive with heap spray or other kernel exploitation techniques to redirect execution flow and gain kernel-level privileges (GitHub Advisory).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing repeated Sony HID probe failures or errors such as input: Failed to register input device followed by unexpected kernel oops or BUG traces referencing hid-sony or sony_probe.
• Process: Unexpected privilege escalation events or processes running as root spawned from non-privileged user sessions shortly after HID device attachment events.
• File System: Unexpected kernel module loads or modifications to HID-related kernel objects; presence of exploit staging files in /tmp or world-writable directories.
• Network: Outbound connections from the host to unknown IPs following HID device attachment, which may indicate post-exploitation activity.

Apply the kernel patches that fix the use-after-free: stable commits 3b4709e4864908bb06c48c500cc8db8d3d55d139, d044d796e2a369c6051c7e83dce88c7baa2494d4, and 7c65699a3a311198a07659a614fe64d45924839e for the respective stable branches. Fixed versions include Linux 6.18.51, 7.2.5, and 7.3-rc1 (GitHub Advisory). As a workaround where patching is not immediately possible, restrict unprivileged HID device attachment (e.g., via udev rules or USB authorization) or blacklist/disable the hid-sony kernel module if Sony HID controllers are not required on the system.

The vulnerability was discovered by 0sec (https://0sec.ai) using automated source analysis and reported to the Linux kernel security team, following standard kernel CVE disclosure processes via the linux-cve-announce mailing list. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified at this time.