Circular Locking Dependency in Linux Kernel Affecting Input Devices

CVE-2026-31667

What is CVE-2026-31667?

A circular locking dependency has been identified in the Linux kernel's uinput subsystem that can occur when using force-feedback gamepads, particularly highlighted during gaming sessions such as ELDEN RING with certain controllers. Specifically, the issue arises from multiple paths for lock acquisition that lead to a deadlock scenario, inhibiting the game's responsiveness. The resolution involves introducing a state_lock spinlock to manage device state changes without introducing cyclical dependencies. This enhancement allows safe access to the udev state and ensures proper event queuing, significantly improving system stability and performance during input operations.

References