Linux Kernel Nintendo HID Rumble Worker Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in the Linux kernel's HID Nintendo driver. This issue arises when the driver attempts to queue work to a workqueue that has already been destroyed. Specifically, when a device is disconnected, the 'nintendo_hid_remove' function is called, which destroys the 'rumble_queue'. The vulnerability can be exploited by deferring rumble work after the controller state is set to 'JOYCON_CTLR_STATE_REMOVED', leading to the null pointer dereference.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, causing a crash or denial of service condition.