CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of Nintendo Joy-Con controllers, where the input device is registered prematurely, exposing it to userspace before all capabilities are properly configured. This can lead to a NULL pointer dereference during concurrent operations and results in incomplete device information being sent to input managers, potentially causing them to ignore the device. Linux distributions and developers working with Joy-Con support should prioritize addressing this issue to ensure proper device functionality and stability.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input_register_device() exposes the device to userspace immediately. In joycon_input_create() it was called before joycon_config_rumble() configures the FF_RUMBLE capability and the memless force-feedback device, so a concurrent EVIOCSFF could dereference a NULL dev->ff. Registering early also means the initial udev event lacks button and axis information, which can make input managers ignore the device. Move input_register_device() to the end of joycon_input_create(), after all capabilities, the IMU input device and the force-feedback callbacks have been configured.