The HID force‑feedback driver (pidff) on Linux contains an out‑of‑bounds write path in the initialization function hid_pidff_init_with_quirks(). The routine derives a device structure pointer from an empty input list without validation, causing set_bit calls to overwrite memory beyond the object. The write occurs during device probe on the USB hotplug workqueue, with no need for user interaction. If triggered, the corruption can lead to arbitrary kernel memory overwrite, potentially granting an attacker privilege escalation or causing a kernel panic.

The flaw resides in the Linux kernel's HID subsystem, affecting all kernel releases that include the pidff driver. Since the commit references indicate the issue was present until a patch was applied, any distribution running an unpatched kernel is vulnerable. The published references point to multiple kernel commits, indicating the fix was merged after the vulnerability was disclosed, but the specific version is not listed, so the safest assumption is that all kernels prior to the commit remain affected.

No EPSS score is published and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker only needs to plug a malicious USB HID device that uses the PID usage page and an application collection without inputs, a scenario that can be executed by a local player with physical access. The resulting out‑of‑bounds write could crash the kernel or enable privilege escalation, giving the attacker full control of the system. Patch deployment is the only definitive protection.