Skip to main content

Linux Kernel CVE-2026-64427

| EUVDEUVD-2026-48771 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-25 Linux GHSA-m6mf-crm7-82wq
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low privileges (uhid or physical USB) required; crash-only impact with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 04, 2026 - 17:17 vuln.today
CVSS changed
Sep 04, 2026 - 15:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:51 nvd
MEDIUM 5.5
CVE Published
Jul 25, 2026 - 08:51 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

HID: logitech-dj: Fix maxfield check in DJ short report validation

Commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") added validation for the DJ short output report, but the error path dereferences rep->field[0] even when rep->maxfield is zero.

Commit 8b9a097eb2fc ("HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report") made the check conditional on rep being present, but a crafted descriptor can still create report ID 0x20 with only padding output items. hid-core registers the report, ignores the padding field, and leaves rep->maxfield as zero.

In that case the validation enters the rep->maxfield < 1 branch and then dereferences rep->field[0]->report_count while printing the error message, causing a NULL pointer dereference during probe. This is reproducible with uhid by emulating a Logitech receiver with a padding-only DJ short output report:

BUG: KASAN: null-ptr-deref in logi_dj_probe+0xb1/0x754 [hid_logitech_dj] Read of size 4 at addr 0000000000000028 by task kworker/4:1/129 ... Call Trace: logi_dj_probe+0xb1/0x754 [hid_logitech_dj] hid_device_probe+0x329/0x3f0 [hid] really_probe+0x162/0x570 __device_attach+0x137/0x2c0 bus_probe_device+0x38/0xc0 device_add+0xa56/0xce0 hid_add_device+0x19c/0x280 [hid] uhid_device_add_worker+0x2c/0xb0 [uhid]

Reject the zero-field report before printing the field report_count.

AnalysisAI

NULL pointer dereference in the Linux kernel's hid_logitech_dj driver causes a kernel crash (DoS) when a crafted HID descriptor is processed during device probe. The flaw exists in logi_dj_probe(): when a Logitech Unifying receiver emulation presents report ID 0x20 with only padding output items, hid-core registers the report with rep->maxfield == 0. The error-path validation then dereferences rep->field[0]->report_count while printing a diagnostic message, triggering a KASAN-visible null-ptr-deref and kernel panic. No public exploit is identified at time of analysis, but the kernel commit descriptions include a full uhid-based reproduction method, lowering the barrier for local attackers.

Technical ContextAI

The vulnerability resides in the HID (Human Interface Device) subsystem's logitech-dj driver (hid_logitech_dj module), which handles Logitech Unifying and DJ receivers. The root cause is CWE-476 (NULL pointer dereference): two prior patches (b6a57912854e, 8b9a097eb2fc) attempted to validate DJ short output reports (report ID 0x20) but left a gap - when a crafted descriptor populates report ID 0x20 with only HID padding output items, hid-core registers the report yet leaves rep->maxfield as zero because padding fields are ignored. The probe-time guard checks maxfield < 1 and enters the error branch, but the subsequent pr_err() call still reads rep->field[0]->report_count before the return, dereferencing a NULL pointer. The bug is reproducible via the uhid interface, which allows user-space to emulate arbitrary USB HID devices. Affected CPE (as recorded): cpe:2.3:a:linux:linux.

RemediationAI

Upgrade to Linux kernel 7.1.4 or 7.2-rc3 (or later), which contain the fix that rejects the zero-field report before accessing rep->field[0]. Stable-branch patches are available at https://git.kernel.org/stable/c/590cc4d782487632a52f37c2171bee1eeea29627 and https://git.kernel.org/stable/c/7a89ad762fad53d56b7002d7ffc923a4b7f4006f. For systems that cannot be immediately patched, restrict access to the uhid interface by tightening /dev/uhid permissions (mode 0600, root-only) or removing udev rules that grant it to unprivileged users; this eliminates the software-emulation attack path. Additionally, enforce USB device allowlisting via USBGuard or kernel USB authorization (echo 0 > /sys/bus/usb/devices/usbX/authorized_default) on physically exposed ports to prevent malicious hardware from triggering the probe path. Blacklisting the hid_logitech_dj module (modprobe.d: blacklist hid_logitech_dj) is a drastic but effective workaround for environments that do not use Logitech Unifying receivers, at the cost of disabling all supported Logitech receiver functionality.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

CVE-2026-64427 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy