The Linux kernel HID plug‑and‑play module fails to report probe errors correctly, resulting in a NULL pointer dereference when force‑feedback (FF) functionality is first used. This bug can cause the system to crash or panic, interrupting all services and potentially requiring a reboot. The vulnerability affects confidentiality and integrity only indirectly, as the crash does not provide direct data disclosure or code execution.

Vulnerable systems are Linux kernels that include the HID‑PL subsystem before the fix. The exact affected releases are not listed, but any kernel version not containing the commit that resolves the probe error is at risk. Administrators should review the release notes of upcoming kernel versions for the addressed change.

Based on the description, it is inferred that the likely attack vector is a user or attacker who can use force‑feedback capabilities on a connected HID device, such as a game controller or joystick. In such an environment, triggering the force‑feedback action would cause the kernel to follow a NULL pointer during the first use, leading to a crash. The lack of a KEV or EPSS entry indicates that public exploitation has not been observed, but a local or device‑based denial of service remains possible. The potential for a kernel panic suggests high impact if the flaw is triggered. The exploitability depends on the attacker’s ability to interact with a HID device that exercises force‑feedback.