Linux Kernel CVE-2026-43049

Attack requires local authenticated access (PR:L from CVSS vector) to a Linux system running vulnerable kernel version. Specific hardware prerequisite is physical connection of Logitech G920 Driving Force Racing Wheel for Xbox One via USB, which must undergo force feedback initialization failure during device probe. Exploitation is limited to x86/x64 and ARM platforms where this USB gaming peripheral is supported. Attack complexity is low (AC:L) post-setup but requires attacker control over device probe timing and ability to maintain userspace references during error conditions. No special kernel configuration or non-default settings required beyond standard HID subsystem support (CONFIG_HID_LOGITECH_HIDPP=y/m). User interaction not required (UI:N). The hardware dependency significantly limits real-world attack surface to gaming systems and esports facilities rather than enterprise servers or embedded systems.

Real-world exploitation risk is LOW despite the 7.8 CVSS score. The attack vector is local (AV:L) requiring low privileges (PR:L) and physical presence of a specific Logitech G920 racing wheel, dramatically limiting the attack surface compared to network-exploitable kernel vulnerabilities. EPSS score of 0.02% at 5th percentile confirms security community assessment that this is unlikely to see widespread exploitation. No CISA KEV listing and no public exploit code identified at time of analysis. The SSVC framework would classify this as 'Scheduled' priority: technical impact is total system compromise (UAF enables arbitrary code execution in kernel context), but exploitation requires local access, specific hardware, and race conditions against device initialization timing. Attack complexity is low (AC:L) once prerequisites are met, but the narrow hardware dependency (gaming peripheral) and local-only vector make this primarily relevant for gaming workstations and shared gaming systems rather than servers or cloud infrastructure. Organizations without Logitech G920 devices can safely deprioritize. CVSS accurately reflects post-exploitation impact but overweights risk for typical enterprise environments where this hardware is absent.

Local attacker with standard user account on a Linux gaming workstation connects a Logitech G920 racing wheel and triggers force feedback initialization failure through malformed device firmware or by manipulating /sys entries during device probe. The attacker maintains open file descriptors to /dev/input/eventX and sysfs nodes while the kernel frees underlying memory structures. By racing read/write operations against the freed memory region, the attacker corrupts kernel heap metadata or function pointers, achieving arbitrary kernel code execution and escalating to root privileges. Publicly available exploit code exists: NO. Attack requires precise timing and heap grooming techniques typical of kernel UAF exploitation.