Input Device Management Issue in Sony Controllers by Linux Vendor

CVE-2026-90041

What is CVE-2026-90041?

In the Linux kernel, a vulnerability has been identified in the handling of Sony input controllers during the probe process. When the sony_input_configured function adds controllers to the sony_device_list, it occurs before the HID core has registered their input devices. If the input_register_device() fails after this addition, the sony_probe function attempts to unwind the process without properly managing the state of the associated device structures. This can lead to attempts to access freed memory when subsequent matching controllers are processed. The solution involves initializing device list nodes and IDs to inactive states, ensuring idempotent list removal, and performing necessary driver-private cleanups across all probe failure paths, enhancing the robustness of the driver against such scenarios.

References