Executive brief
A vulnerability in the Linux kernel's Logitech HID++ driver could allow a person with physical access to crash the system. By plugging in a specially crafted USB device, an attacker can trigger a kernel crash, leading to a denial of service. This affects systems using Logitech input devices or drivers that process HID (Human Interface Device) reports.
Technical details
A vulnerability exists in the 'hid-logitech-hidpp' driver within the Linux kernel due to a lack of validation in the 'hidpp_get_report_length()' function. Specifically, the driver fails to check the 'maxfield' value before accessing report fields. An attacker can use a fake USB gadget to send a HID report descriptor that defines a report structure without valid fields, triggering a null pointer dereference or out-of-bounds access that crashes the kernel. The issue has been resolved by adding a check for '!report->maxfield' in the affected function. Patches are available across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.2 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-01-10: patched: Initial patch committed to stable tree
References
- https://git.kernel.org/stable/c/1547d41f9f19d691c2c9ce4c29f746297baef9e9
- https://git.kernel.org/stable/c/1acb28123e57b50d737377f400f57eec889fe5e4
- https://git.kernel.org/stable/c/2dc023dbc11b8dfa8afa63242762acd8cddcad03
- https://git.kernel.org/stable/c/7f59999fcd699af06ad2aef446a635ea6aa87db3
- https://git.kernel.org/stable/c/ae81fac9ce81917817d787e6b74e68482d99bdf2
- https://git.kernel.org/stable/c/b74bf7d0d01fa9b53653f58c29aa00772121f6e9
- https://git.kernel.org/stable/c/f1ceaaf93ea32d0f2b95c95f784ee155962c52ad