Skip to main content

Linux Kernel CVE-2026-45969

| EUVDEUVD-2026-32253 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-rvgc-6x75-qw2f
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only vector with low-privilege access to trigger FF ioctls; no confidentiality or integrity impact, only kernel crash.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 16, 2026 - 02:53 vuln.today
CVSS changed
Jun 16, 2026 - 02:52 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

HID: playstation: Add missing check for input_ff_create_memless

The ps_gamepad_create() function calls input_ff_create_memless() without verifying its return value, which can lead to incorrect behavior or potential crashes when FF effects are triggered.

Add a check for the return value of input_ff_create_memless().

AnalysisAI

NULL pointer dereference in the Linux kernel HID PlayStation driver crashes the kernel when force feedback (FF) effects are triggered on a PlayStation controller that experienced a silent initialization failure. Systems running Linux 5.12 through unpatched stable branches with PlayStation controllers (DualSense, DualShock 4, or compatible HID devices) attached are affected. A local low-privileged attacker who can trigger FF effects on a controller where input_ff_create_memless() returned an error can cause a kernel panic, resulting in a full system denial of service. No public exploit exists and EPSS is 0.02% (7th percentile), consistent with a niche hardware driver flaw.

Technical ContextAI

The vulnerability resides in drivers/hid/hid-playstation.c, specifically in the ps_gamepad_create() function, which configures force feedback (rumble) support for PlayStation-compatible HID input devices. The function invokes input_ff_create_memless(), a kernel API that allocates and registers a memoryless force feedback handler for an input device. If this allocation fails - for instance, due to memory pressure - the function returns an error code or NULL, but ps_gamepad_create() does not check this return value. CWE-476 (NULL Pointer Dereference) applies: subsequent kernel code paths that assume the FF structure was successfully initialized will dereference a NULL or garbage pointer when an application triggers a FF effect, causing a kernel oops or panic. Affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple stable series from approximately 5.12 onward.

RemediationAI

Apply the vendor-released stable kernel patches: upgrade to 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, or 6.19.4, depending on the stable series in use. The upstream fix commits are available at https://git.kernel.org/stable/c/33acf9a4d6eb1f6d01691faca96ad6b2ab0fcfc0, https://git.kernel.org/stable/c/45b01d85265bc1ccdd69e0a7887db4b905a778f4, https://git.kernel.org/stable/c/987dee1486e975e2baa6a5d062cfdf18bbe901c8, https://git.kernel.org/stable/c/d955aeb26e1210a018492b3b32cbdfaf017aaa25, https://git.kernel.org/stable/c/e6807641ac94e832988655a1c0e60ccc806b76dc, https://git.kernel.org/stable/c/496a345cc047a2c2d9d5a76956e1182525578bd5, and https://git.kernel.org/stable/c/35301ca2a83d17aac2f3e8e35c696f0da2a13111. As a compensating control where immediate patching is not possible, administrators can blacklist or unload the hid-playstation kernel module (rmmod hid-playstation; echo 'blacklist hid-playstation' >> /etc/modprobe.d/hid-playstation.conf), which prevents PlayStation HID devices from binding to this driver; this disables DualSense and DualShock 4 support entirely and is a significant functional trade-off.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-45969 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy