Linux kernel Logitech HIDPP use-after-free allows local privilege escalation
ZDI rates CVE-2026-93826 at CVSS 7.8 and requires existing low-privileged code execution.
44
CVE-2026-93826
Use-After-Free in Linux Kernel's Logitech HID++ (hidpp) Driver
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The Linux kernel's HID hidpp driver, which handles Logitech HID++ wireless peripherals (e.g., Unifying/Bolt receivers and Bluetooth devices), leaves a dangling pointer in hidpp->input after freeing an input device when input_register_device() fails during hidpp_connect_event(). An attacker with adjacent access — able to attach or emulate a Logitech HID++ device so that input registration fails — could trigger a use-after-free, corrupting kernel memory and causing a crash or potentially escalating privileges. Any Linux system running a kernel containing the vulnerable hidpp code is affected in principle, though the bug sits on an uncommon error path that requires input device registration to fail. The flaw is rated High (CVSS 3.1: 7.5, adjacent attack vector, high attack complexity, no privileges or user interaction required). There is no public PoC, no known exploitation in the wild, and it is not listed in CISA's KEV.
What to do: Apply your distribution's kernel update containing the fix (the commit that sets hidpp->input to NULL after input_free_device() on the failure path) once it is released. If Logitech HID++ peripherals are not needed, blacklist the hid-logitech-hidpp module to eliminate the code path entirely. Since exploitation requires adjacent access to trigger a failed input registration, also enforce USB port restrictions and strict wireless pairing/receiver policies on sensitive hosts.
| Product | Affected |
|---|---|
| Linux kernel (HID hidpp / Logitech HID++ driver) | — |
Estimated exposure
mass≈tens of millions of Linux systems (driver ships in all major distribution kernels) — The hidpp driver is part of mainline Linux shipped by every major distribution, and the global Linux desktop/server/embedded installed base is estimated in the tens of millions; however, only systems that actually connect Logitech HID++…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidpp_connect_event() If input_register_device() fails, we call input_free_device(), but keep stale pointer to the old device in hidpp->input, which could potentially lead to UAF. Fix that by resetting it to NULL before returning from hidpp_connect_event().
- Vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H