VDB
CVE-2026-27969
CVE-2026-27969
PUBLISHED
CVSS 9.300000190734863 CRITICAL
In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.
EPSS 0.40% · 33.0th percentile
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:H/SA:H
EPSS Score
0.40%
33.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| linuxfoundation | vitess | 23.0.0, 0 |
| vitessio | vitess | < 22.0.4, >= 23.0.0, < 23.0.3 |
| Linux | Linux | *, 0, 5.10.249 |
| vitess.io | vitess | 0, 0.23.0-rc1 |
| linux | linux_kernel | 4.1, 4.1, 4.1 |
Timeline
- Oct 16, 2025 PoC Published
- Oct 17, 2025 PoC Published
- Oct 21, 2025 PoC Published
- Dec 2, 2025 PoC Published
- Dec 18, 2025 PoC Published
- Dec 19, 2025 PoC Published
- Dec 26, 2025 PoC Published
- Dec 29, 2025 PoC Published
- Dec 30, 2025 PoC Published
- Dec 30, 2025 PoC Published
- Dec 30, 2025 PoC Published
- Jan 7, 2026 PoC Published
References
- https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw url
- https://github.com/vitessio/vitess/pull/19470 url
- https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a url
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-22982 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-22991 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-54207 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-22980 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-22978 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-71147 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27969 advisory
- https://github.com/vitessio/vitess package
- https://owasp.org/www-community/attacks/Path_Traversal url
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-22998 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27965 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-71163 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-22992 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-22999 advisory
- https://git.kernel.org/stable/c/f78bb490b16ecb506d4904be4b00bf9aad6588f9 url
- https://git.kernel.org/stable/c/51f49e3927ad545cec0c0afb86856ccacd9f085d url
- https://git.kernel.org/stable/c/f283805d984343b2f216e2f4c6c7af265b9542ae url
…and 10 more