CVE-2026-98645 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches or workarounds to prevent exploitation. This includes operators managing Linux-based infrastructure, platform administrators, vulnerability management teams, and security teams responsible for monitoring and defending Linux systems.

Why it matters

The vulnerability requires verification of Linux kernel versions and exposure assessment. Defenders should prioritize patching or applying workarounds to prevent potential exploitation.

• Potential system crashes or instability due to double free
• Possible elevation of privileges or arbitrary code execution

Technical summary

The Linux kernel's HID winwing driver has a use-after-free vulnerability. The driver's private data is allocated with devm_kzalloc() and passed as the effect context to input_ff_create_memless(). The memoryless force-feedback core frees this pointer with kfree() from input_ff_destroy() when the input device is destroyed. However, this is an invalid free because it's a devm-managed allocation. The object is then released again by devres when the HID device is torn down, resulting in a double free.

Defensive priority

Assess exposure and apply patches or workarounds to prevent exploitation.

Recommended defensive actions

• Assess exposure by checking if the Linux kernel version is affected
• Apply patches or workarounds provided by the Linux kernel maintainers
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by passing NULL as the memless context instead and fetching the driver data from the input device in winwing_play_effect(). The fix addresses a double free issue by changing how the driver's private data is handled during force-feedback teardown. This change prevents the invalid free of devm-managed allocations and subsequent memory corruption. Defenders should verify Linux kernel versions, assess exposure, and apply patches or workarounds to prevent potential exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.