The Linux kernel HID subsystem contains an unchecked pointer that can be left dangling when input_register_device() fails. The fix clears this pointer in hidpp_connect_event() before returning, but the old code would retain a stale reference in hidpp->input. This use‑after‑free can lead to a kernel crash and, if an attacker can control the freed memory, may be leveraged to execute malicious code with kernel privileges. The weakness is a classic kernel UAF flaw, classified as a privileged denial of service and a potential privilege escalation vector when exploitation conditions are met.

All Linux kernel releases that incorporate the HID driver before commit 3303398cc2aa255ba251650a30024e11d48ea6c3 are affected. Distributions using kernels older than this commit lack the patch that nullifies the stale pointer. The bug is vendor‑agnostic as it resides in the core kernel's hidpp module.

The CVSS score is not provided, and EPSS data is unavailable, so the exact probability of exploitation cannot be quantified. The vulnerability requires a failure in input_register_device(), which generally occurs in the context of device registration or during USB/HID operations. An attacker would need local authority to trigger the condition or would need to supply a malicious HID device to the target system. Because the flaw exists in kernel space, successful exploitation could crash the system or potentially allow kernel‑level code execution, but no publicly reported exploits are listed in CISA’s KEV catalog.