VYPR
Medium severity5.5NVD Advisory· Published May 6, 2026· Updated May 13, 2026

CVE-2026-43152

CVE-2026-43152

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: hid-pl: handle probe errors

Errors in init must be reported back or we'll follow a NULL pointer the first time FF is used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's HID subsystem, the hid-pl driver fails to propagate initialization errors, leading to a NULL pointer dereference when force feedback (FF) is used.

Vulnerability

The HID hid-pl driver in the Linux kernel improperly handles initialization errors. When a device probe fails, the error is not reported back to the HID core, leaving internal structures uninitialized. This causes a NULL pointer dereference the first time force feedback (FF) is accessed (e.g., via ioctl calls).

Exploitation

To exploit, an attacker needs to connect a malicious USB HID device that triggers a probe error while still being registered. This could be achieved without special privileges beyond physical access or the ability to attach a device. The vulnerability is triggered when the system attempts to use FF capabilities, typically requiring user interaction or application usage.

Impact

The impact is a denial of service (DoS) through a kernel crash or panic. In some environments, this could be leveraged for repeated system unavailability.

Mitigation

The fix has been applied in Linux kernel stable updates. Users should update to the latest kernel version that includes the commits addressing this issue. No workaround is available without a kernel patch.

AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
    Range: >=2.6.21,<5.10.252

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.