Executive brief
A vulnerability was identified in the Linux kernel's handling of Human Interface Devices (HID), such as keyboards and mice. An error in how the system processes high-resolution input data could allow a local user to cause a system crash or instability. This issue primarily impacts the availability of the affected system.
Technical details
A vulnerability exists in the Linux kernel HID core within the hid_apply_multiplier() function. The code incorrectly assumed that every Resolution Multiplier control must be contained within a Logical Collection. If a specially crafted HID report defines a Resolution Multiplier outside of a Logical Collection, the routine fails to properly handle the null or non-logical collection pointer, leading to undefined behavior or a kernel crash. This was discovered via syzbot fuzzing. Patches have been released across multiple stable kernel branches to ensure the multiplier_collection pointer is correctly set to NULL when a Logical Collection is not found.
Affected products
- Linux Linux Kernel 5.0 to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.76, 6.7 to 6.12.13, 6.13 to 6.13.2
Timeline
- 2019: other: Initial syzbot report connected to this issue
- 2025-01-09: patched: Mainline patch committed
- 2025-02-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/05dd7d10675b540b8b7b31035c0a8abb6e6f3b88
- https://git.kernel.org/stable/c/3a002e4029230d9a6be89f869b2328b258612f5c
- https://git.kernel.org/stable/c/64f2657b579343cf923aa933f08074e6258eb07b
- https://git.kernel.org/stable/c/a32ea3f982b389ea43a41ce77b6fb70d74006d9b
- https://git.kernel.org/stable/c/a5498f1f864ea26f4c613c77f54409c776a95a90
- https://git.kernel.org/stable/c/bebf542e8d7c44a18a95f306b1b5dc160c823506
- https://git.kernel.org/stable/c/ebaeca33d32c8bdb705a8c88267737a456f354b1