{"id":"CVE-2026-98645","kind":"vulnerability","aliases":["CVE-2026-98645"],"related":[],"title":"Linux kernel: WinWing HID force-feedback teardown double-frees memory on unbind","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: winwing: fix use-after-free in force feedback teardown\n\nwinwing_init_ff() passes the driver's private data, allocated with\ndevm_kzalloc() in winwing_probe(), as the effect context to\ninput_ff_create_memless(). The memoryless force-feedback core takes\nownership of that pointer and frees it with kfree() from\ninput_ff_destroy() (ml_ff_destroy()) when the input device is\ndestroyed.\n\nFreeing a devm-managed allocation with kfree() is an invalid free, and\nthe same object is then released again by devres when the HID device is\ntorn down, a double free. As the allocation also embeds the LED class\ndevices, their timers and work item live on freed memory and the slab\ngets corrupted. This triggers on unbind, rmmod, hot-unplug and on system\nsuspend, where the firmware cache walks the now-corrupt devres list.\nKASAN reports:\n\n  BUG: KASAN: invalid-free in input_ff_destroy\n  Allocated by task N:\n    winwing_probe\n\nPass NULL as the memless context instead and fetch the driver data from\nthe input device in winwing_play_effect(): the HID core already stores\nthe hid_device as the input device's drvdata. The force-feedback core\nthen owns nothing that it must not free.","summary":"The WinWing HID driver in the Linux kernel passes devres-managed memory to the force-feedback core, which frees it with kfree() on device teardown. The same allocation is then freed again by devres, causing a use-after-free and double free that can corrupt kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hid","kernel","linux","runtime","winwing"],"not_affected_if":["driver-not-loaded","no-winwing-device"],"how_to_check":"- Check whether the WinWing HID driver (hid-winwing) is loaded with `lsmod | grep winwing`\n- Check the kernel version with `uname -r` and compare against the fixed release in the NVD entry unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing HID: winwing force-feedback teardown (version unknown from the sources)","status":"open","published_at":"2026-10-18T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:20:49+00:00","updated_at":"2026-10-25T05:20:49+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:20:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing HID: winwing force-feedback teardown (version unknown from the sources)","reach":"local","title":"Linux kernel: WinWing HID force-feedback teardown double-frees memory on unbind","impact":"high","summary":"The WinWing HID driver in the Linux kernel passes devres-managed memory to the force-feedback core, which frees it with kfree() on device teardown. The same allocation is then freed again by devres, causing a use-after-free and double free that can corrupt kernel memory.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","hid","winwing"],"confidence":0.6,"needs_auth":"no","worst_case":"kernel memory corruption, possible local privilege escalation or crash","analyst_note":"Confirm fixed kernel versions and stable backport commits from the NVD entry and kernel.org stable mailing list; the sources give no versions.","how_to_check":"- Check whether the WinWing HID driver (hid-winwing) is loaded with `lsmod | grep winwing`\n- Check the kernel version with `uname -r` and compare against the fixed release in the NVD entry unknown","needs_analyst":true,"not_affected_if":["no-winwing-device","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the winwing HID driver, typically hosts with WinWing flight or sim input devices attached. The bug triggers on driver unbind, module removal, hot-unplug or system suspend, so machines without WinWing hardware or with the driver not loaded can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":3655,"output_tokens":596,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98645':17A,20A 'alloc':55B,106C,156C,185C,240C 'alreadi':269C 'also':186C 'bug':231C 'cach':221C 'caus':62B 'class':190C 'context':116C,251C 'core':44B,127C,268C,284C 'corrupt':73B,205C,226C 'creat':120C 'cve':15A,18A 'data':105C,257C 'destroy':141C,144C,150C,239C 'devic':51B,148C,176C,191C,261C,273C,277C 'devm':108C,154C 'devm-manag':153C 'devr':36B,61B,172C,227C 'devres-manag':35B 'doubl':10A,69B,181C 'double-fre':9A 'driver':29B,102C,256C 'drvdata':279C 'effect':115C,265C 'emb':187C 'feedback':7A,43B,95C,126C,283C 'fetch':254C 'ff':99C,119C,140C,143C,238C 'firmwar':220C 'fix':88C 'follow':81C 'forc':6A,42B,94C,125C,282C 'force-feedback':5A,41B,124C,281C 'free':11A,46B,67B,70B,92C,134C,151C,162C,182C,235C,292C 'freed':58B,199C 'get':204C 'hid':4A,21B,28B,86C,175C,267C,272C 'hot':212C 'hot-unplug':211C 'init':98C 'input':118C,139C,147C,237C,260C,276C 'instead':252C 'invalid':161C,234C 'invalid-fre':233C 'item':196C 'kasan':229C,232C 'kernel':2A,22B,33B,74B,79C 'kfree':49B,137C,158C 'kzalloc':109C 'led':189C 'linux':1A,23B,32B,78C 'list':228C 'live':197C 'manag':37B,155C 'memless':121C,250C 'memori':12A,38B,75B,200C 'memoryless':123C 'ml':142C 'must':290C 'n':243C 'noth':287C 'now-corrupt':224C 'null':247C 'object':166C 'own':286C 'ownership':129C 'pass':34B,100C,246C 'play':264C 'pointer':132C 'privat':104C 'probe':112C,245C 'releas':169C 'report':230C 'resolv':85C 'rmmod':210C 'runtim':24B 'slab':203C 'store':270C 'suspend':217C 'system':216C 'take':128C 'task':242C 'teardown':8A,52B,96C 'timer':193C 'torn':178C 'trigger':207C 'unbind':14A,209C 'unplug':213C 'use':65B,90C 'use-after-fre':64B,89C 'vulner':82C 'walk':222C 'winw':3A,25B,27B,87C,97C,111C,244C,263C 'work':195C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the winwing HID driver, typically hosts with WinWing flight or sim input devices attached. The bug triggers on driver unbind, module removal, hot-unplug or system suspend, so machines without WinWing hardware or with the driver not loaded can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98645","severity":null,"published_at":"2026-10-18T16:17:17+00:00","modified_at":"2026-10-19T10:19:28+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}