Executive brief
A vulnerability in the Linux kernel's ChromeOS Embedded Controller keyboard driver could allow a local attacker to cause a system crash. The issue occurs when the system receives unexpected keyboard events that the driver is not prepared to handle, leading to an invalid memory access. This primarily impacts system availability by causing a kernel panic or 'Blue Screen' equivalent on affected devices.
Technical details
A NULL pointer dereference exists in the cros_ec_keyb driver within the Linux kernel. When the driver is initialized in a mode that only supports buttons and switches (`buttons_switches_only`), the input device structure (`ckdev->idev`) is not initialized. However, if the kernel subsequently receives an `EC_MKBP_EVENT_KEY_MATRIX` event, the `cros_ec_keyb_work()` function attempts to access this NULL pointer. This results in an invalid memory access and a kernel oops. The vulnerability has been patched by adding a check to ensure `ckdev->idev` is valid before processing matrix events.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.11, 6.12, 6.13
Timeline
- 2025-11-04: other: Initial patch authored
- 2025-12-04: disclosed: CVE published
- 2025-12-01: patched: Patch committed to stable branches
References
- https://git.kernel.org/stable/c/2d251c15c27e2dd16d6318425d2f7260cbd47d39
- https://git.kernel.org/stable/c/6d81068685154535af06163eb585d6d9663ec7ec
- https://git.kernel.org/stable/c/9cf59f4724a9ee06ebb06c76b8678ac322e850b7
- https://git.kernel.org/stable/c/d74864291cb8bd784d44d1d02e87109cf88666bb
- https://git.kernel.org/stable/c/e08969c4d65ac31297fcb4d31d4808c789152f68
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html