The Linux kernel's universal-pidff HID driver starts the device with hid_hw_start() and then attempts force-feedback initialization. If this initialization fails, the driver returns an error without stopping the device. Because the HID core does not unwind the device state on the driver's behalf, the device remains started but with no driver attached. The hidraw character device created during start remains registered and accessible. Opening this device leads to use-after-free writes due to operations on freed memory, as the device's transport open callback takes a spinlock inside the freed object. The vulnerability is triggered by a descriptor with a PID usage page and no input reports, causing force-feedback initialization to fail while the device is started. The fix stops the device properly when force-feedback initialization fails, preventing the use-after-free condition.

This vulnerability can cause use-after-free writes in kernel memory when opening the hidraw device after force-feedback initialization failure. This may lead to kernel memory corruption, potential system instability, or privilege escalation if exploited. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to stop the device when force-feedback initialization fails in the universal-pidff driver. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official patch and update guidance.