During promotion of the Nintendo Joy‑Con HID driver, the kernel starts HID device IO before fully initializing driver state. If initialization fails, the error path closes the hardware without stopping IO, so background reporting still runs and accesses freed memory. This creates a classic use‑after‑free in the kernel, which can corrupt kernel memory and may let an attacker execute arbitrary code or gain elevated privileges. The flaw is a direct failure to clean up after IO start, rather than a logic error in data handling.

The vulnerability exists in the Linux kernel’s HID Nintendo driver. All kernel builds that include the affected nintendo_hid module are impacted, as the code path is generic to the Linux kernel. No specific version strings are listed, so any recent kernel that ships the driver is potentially vulnerable. The affected vendor is Linux:Linux.

The vulnerability has a use‑after‑free type weakness, which is high severity for kernel space. No public exploit is known and the flaw is not listed in CISA KEV, suggesting no widespread exploitation yet. Because the flaw is triggered by a USB device, a local attacker with control over a system’s USB ports could connect a malicious Joy‑Con or emulate one to trigger the bug. The EPSS score is unavailable, so the current likelihood of exploitation cannot be quantified, but the potential impact warrants prompt remediation.