In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwing_init_ff()… (CVE-2026-98645)

The Linux kernel HID winwing driver had a use-after-free vulnerability caused by freeing a devm-managed allocation with kfree(), resulting in a double free and slab corruption. Specifically, winwing_init_ff() passed the driver's private data as the effect context to input_ff_create_memless(), which took ownership and freed it improperly. This caused corruption of embedded LED class devices and their timers/work items, triggering errors on device teardown and system suspend. The fix involves passing NULL as the memless context and retrieving driver data from the input device, ensuring the force-feedback core does not free memory it does not own.

This vulnerability could cause kernel memory corruption and instability during device removal or system suspend operations. It may lead to crashes or unpredictable behavior due to double free and use-after-free conditions in kernel memory management.

A fix has been implemented in the Linux kernel to correct the memory management in the HID winwing driver. Users should update to a kernel version that includes this fix. No additional mitigation is required as the issue is resolved by the official patch.