CVE-2026-90041

CVE-2026-90041 is a use-after-free in the Linux kernel's HID 'sony' driver (drivers/hid/hid-sony.c) caused by incorrect cleanup when controller probing fails. When a Sony controller is connected, sony_input_configured() links its state into sony_device_list before the input device is registered; if input_register_device() then fails, sony_probe() frees the driver state (via devres) while the list node is still linked, leaving a dangling entry in the shared device list. A subsequent controller connection that traverses the list touches freed memory, which could be leveraged for memory corruption or a crash by an attacker with local/adjacent access — such as plugging in or pairing over USB/Bluetooth a crafted or malfunctioning Sony-class HID device — consistent with the CVSS 8.8 (high, adjacent network, C:H/I:H/A:H) score. Any Linux system whose kernel includes the sony HID driver is affected, though the advisory does not specify vulnerable or fixed version ranges. No public proof-of-concept and no known in-the-wild exploitation; the flaw was found by 0sec using automated source analysis.

What to do: Update to a kernel that includes the sony driver probe-failure cleanup patch as soon as your distribution ships it (mainline/stable backport; no fixed version number is given in the advisory). Until then, avoid attaching Sony DualShock-class controllers from untrusted sources to patched-pending systems, or blacklist the hid_sony module where Sony controllers are not needed (verify with 'lsmod | grep hid_sony').