Executive brief
A vulnerability in the Linux kernel's Logitech input driver could allow a malicious or malformed USB device to crash the system. By emulating a Logitech receiver with a specially crafted data structure, an attacker can trigger a system failure (kernel panic). This primarily impacts the availability of the affected machine.
Technical details
A NULL pointer dereference exists in drivers/hid/hid-logitech-dj.c within the logi_dj_probe function. The vulnerability occurs during the validation of DJ short reports; specifically, when a crafted descriptor creates a report ID (0x20) containing only padding, the kernel leaves the 'maxfield' count at zero. The error-handling logic subsequently attempts to dereference 'field[0]' to print a diagnostic message, leading to a crash. This can be exploited via physical device insertion or through the 'uhid' framework to emulate a device. The issue has been resolved by adding a check to reject zero-field reports before the dereference occurs.
Affected products
- Linux Linux Kernel 7.1, 7.2-rc3
Timeline
- 2026-06-18: other: Patch authored
- 2026-07-25: disclosed: CVE published