Skip to main content

Linux Kernel CVE-2026-45969

| EUVDEUVD-2026-32253 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-rvgc-6x75-qw2f
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only vector with low-privilege access to trigger FF ioctls; no confidentiality or integrity impact, only kernel crash.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 16, 2026 - 02:53 vuln.today
CVSS changed
Jun 16, 2026 - 02:52 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

HID: playstation: Add missing check for input_ff_create_memless

The ps_gamepad_create() function calls input_ff_create_memless() without verifying its return value, which can lead to incorrect behavior or potential crashes when FF effects are triggered.

Add a check for the return value of input_ff_create_memless().

AnalysisAI

NULL pointer dereference in the Linux kernel HID PlayStation driver crashes the kernel when force feedback (FF) effects are triggered on a PlayStation controller that experienced a silent initialization failure. Systems running Linux 5.12 through unpatched stable branches with PlayStation controllers (DualSense, DualShock 4, or compatible HID devices) attached are affected. A local low-privileged attacker who can trigger FF effects on a controller where input_ff_create_memless() returned an error can cause a kernel panic, resulting in a full system denial of service. No public exploit exists and EPSS is 0.02% (7th percentile), consistent with a niche hardware driver flaw.

Technical ContextAI

The vulnerability resides in drivers/hid/hid-playstation.c, specifically in the ps_gamepad_create() function, which configures force feedback (rumble) support for PlayStation-compatible HID input devices. The function invokes input_ff_create_memless(), a kernel API that allocates and registers a memoryless force feedback handler for an input device. If this allocation fails - for instance, due to memory pressure - the function returns an error code or NULL, but ps_gamepad_create() does not check this return value. CWE-476 (NULL Pointer Dereference) applies: subsequent kernel code paths that assume the FF structure was successfully initialized will dereference a NULL or garbage pointer when an application triggers a FF effect, causing a kernel oops or panic. Affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple stable series from approximately 5.12 onward.

RemediationAI

Apply the vendor-released stable kernel patches: upgrade to 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, or 6.19.4, depending on the stable series in use. The upstream fix commits are available at https://git.kernel.org/stable/c/33acf9a4d6eb1f6d01691faca96ad6b2ab0fcfc0, https://git.kernel.org/stable/c/45b01d85265bc1ccdd69e0a7887db4b905a778f4, https://git.kernel.org/stable/c/987dee1486e975e2baa6a5d062cfdf18bbe901c8, https://git.kernel.org/stable/c/d955aeb26e1210a018492b3b32cbdfaf017aaa25, https://git.kernel.org/stable/c/e6807641ac94e832988655a1c0e60ccc806b76dc, https://git.kernel.org/stable/c/496a345cc047a2c2d9d5a76956e1182525578bd5, and https://git.kernel.org/stable/c/35301ca2a83d17aac2f3e8e35c696f0da2a13111. As a compensating control where immediate patching is not possible, administrators can blacklist or unload the hid-playstation kernel module (rmmod hid-playstation; echo 'blacklist hid-playstation' >> /etc/modprobe.d/hid-playstation.conf), which prevents PlayStation HID devices from binding to this driver; this disables DualSense and DualShock 4 support entirely and is a significant functional trade-off.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-45969 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy