A high-severity use-after-free vulnerability in the Linux kernel HID driver could allow a local authenticated attacker to achieve code execution or system instability.

The vulnerability exists in the universal_pidff_probe function, where a failure in force-feedback initialization leaves the device in a started state. Because the HID core does not properly unwind the device registration, subsequent interactions with the /dev/hidrawX interface result in a use-after-free condition, requiring local access with low privileges.

Successful exploitation of this flaw allows a local, low-privileged user to trigger memory corruption, which can lead to privilege escalation, arbitrary code execution, or a kernel panic causing a denial of service. Given the CVSS score of 7.8, this represents a significant risk to the integrity and availability of host systems, particularly in multi-tenant or shared computing environments where local access is granted to untrusted users.

Immediate Action: Update the Linux kernel to version 6.18.50, 7.2.4, or the latest stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for repeated kernel oops or segmentation faults related to the hidraw subsystem or HID driver initialization.

Compensating Controls: Restrict access to /dev/hidraw* devices using udev rules or system permissions to ensure only authorized users or processes can interact with HID hardware.

Public Exploit Available: Unknown.

This vulnerability presents a clear risk to system stability and security for local users. Administrators should prioritize patching the kernel to the versions specified in the enrichment data, as these versions contain the necessary logic to ensure device registration is properly cleaned up during probe failures. Failure to patch leaves systems susceptible to local privilege escalation attempts.