The Linux kernel hidpp_ff_init function incorrectly fails to clean up allocated force‑feedback resources when initialization fails after the device has been created. This leaves a force‑feedback device and associated memory still allocated, leading to a resource leak that could be exploited by an attacker who repeatedly triggers the failure path to exhaust kernel memory or input subsystem resources, potentially causing a denial of service. The flaw is a classic resource‑management weakness rooted in improper cleanup code.

The problem exists in all Linux kernel builds that include the HID++ force‑feedback driver before the fix was applied. Any Linux system that enumerates Logitech HID++ force‑feedback devices and runs a kernel prior to the commit referenced in the advisory is vulnerable. No specific version list is supplied, so the issue applies to all versions prior to the patch commit.

The EPSS score is below 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting limited real‑world exploitation. The flaw requires the kernel to attempt to initialize an FF device that fails, which may or may not be controllable by an attacker depending on device behavior or malicious payloads. The impact is local but can lead to service disruption if repeated failures exhaust resources. No public exploits are known.