Executive brief
The Linux kernel's HID (Human Interface Device) driver for Huawei keyboards contains a missing validation check that can cause the system to crash. An attacker or malicious application could create a virtual USB device that triggers this crash, disrupting system availability.
Technical details
The vulnerability is a missing null pointer check in the huawei HID driver's report_fixup function. The code calls to_usb_interface() without first verifying that the HID device is actually backed by a real USB interface; uhid (user-space HID) can create devices that claim to be on BUS_USB but lack an actual USB parent. This causes a null pointer dereference and kernel crash (splat). The fix adds a hid_is_usb() check before calling to_usb_interface() and properly handles the null case. No special privileges or network access is required; a local user can trigger this via uhid. A patch has been committed to the Linux kernel.
Affected products
- Linux Linux kernel multiple versions (patch backported to 4.x, 5.x, 6.x and newer stable branches)
Timeline
- 2026-09-04: disclosed: CVE published
- 2026-08-03: patched: Patch merged upstream by Jiri Kosina
- 2026-08-27: patched: Patch backported to stable branches