Executive brief
A vulnerability in the Linux kernel's Prodikeys HID driver allows a malicious or 'fake' USB device to crash the system. By mimicking a legitimate device but providing unexpected data, the device can trigger a system failure (Blue Screen equivalent). This could be used by an attacker with physical access or local control to cause a denial-of-service, disrupting operations and requiring a system reboot.
Technical details
A NULL pointer dereference exists in the drivers/hid/hid-prodikeys.c component of the Linux kernel. The vulnerability is triggered when a 'fake' USB device provides report descriptors that bypass the input_mapping() hook, leaving the 'pm->input_ep82' pointer uninitialized (NULL). Subsequent processing of reports in pcmidi_handle_report4() attempts to access this pointer, leading to a kernel oops/crash. Attackers can exploit this by emulating a Prodikeys device with a malicious descriptor. Patches have been released across multiple stable kernel branches to add a robustness check for the presence of the pointer before use.
Affected products
- Linux Linux Kernel 2.6.35 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-09: other: Vulnerability fixed in source code by Günther Noack
- 2026-05-06: disclosed: CVE published by kernel.org
- 2026-05-11: advisory: NVD advisory published
References
- https://git.kernel.org/stable/c/3f1b21cc67a15d7d081378a9b8747dd000a017b8
- https://git.kernel.org/stable/c/cee8337e1bad168136aecfe6416ecd7d3aa7529a
- https://git.kernel.org/stable/c/d08f35f843881ec504d7537a9bb728a073db3366
- https://git.kernel.org/stable/c/d5512ce892f774d37c53082adadfcad04f21b50e
- https://git.kernel.org/stable/c/e7ac1cd823cd2e9fcbd5cb0b261d6d35dbb79341
- https://git.kernel.org/stable/c/edccbf7d6dc05d692bde3a89de5a4001f72a0fa4
- https://git.kernel.org/stable/c/ee572578f09f0e743e9383393a75c3a7a0f9b4c2