CVE-2026-64427 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: logitech-dj: Fix maxfield check in DJ short report validation
Commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") added validation for the DJ short output report, but the error path dereferences rep->field[0] even when
rep->maxfield is zero.
Commit 8b9a097eb2fc ("HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report") made the check conditional on rep being present, but a crafted descriptor can still create report ID 0x20 with only padding output items. hid-core registers the report, ignores the padding field, and leaves rep->maxfield as zero.
In that case the validation enters the rep->maxfield < 1 branch and then dereferences rep->field[0]->report_count while printing the error message,
causing a NULL pointer dereference during probe. This is reproducible with uhid by emulating a Logitech receiver with a padding-only DJ short output report:
BUG: KASAN: null-ptr-deref in logi_dj_probe+0xb1/0x754 [hid_logitech_dj]
Read of size 4 at addr 0000000000000028 by task kworker/4:1/129 ... Call Trace: logi_dj_probe+0xb1/0x754 [hid_logitech_dj]
hid_device_probe+0x329/0x3f0 [hid]
really_probe+0x162/0x570 __device_attach+0x137/0x2c0 bus_probe_device+0x38/0xc0 device_add+0xa56/0xce0 hid_add_device+0x19c/0x280 [hid]
uhid_device_add_worker+0x2c/0xb0 [uhid]
Reject the zero-field report before printing the field report_count.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability resides within the Linux kernel's HID (Human Interface Device) subsystem, specifically in the logitech-dj driver responsible for handling Logitech Unifying Receiver devices. This issue represents a NULL pointer dereference occurring during device probe operations when processing malformed DJ short output reports. The flaw manifests as a result of inadequate validation logic that fails to properly handle edge cases where report descriptors contain only padding fields without actual functional fields.
The technical root cause stems from improper validation of the maxfield parameter within the DJ short report validation mechanism. Initially, commit b6a57912854e introduced checks for REPORT_ID_DJ_SHORT related out-of-bounds writes, but subsequent implementation contained a critical oversight where the error handling path still attempted to dereference rep->field[0] even when rep->maxfield was zero. This condition occurs when hid-core processes reports that contain only padding output items, registering the report while ignoring the padding fields and leaving maxfield as zero.
The vulnerability is particularly dangerous because it can be triggered through crafted HID descriptors, specifically those creating report ID 0x20 with exclusively padding output items. The system's handling of such malformed descriptors creates an inconsistent state where the validation logic enters a conditional branch (rep->maxfield < 1) and then attempts to access rep->field[0]->report_count without verifying that field[0] is actually populated. This results in a kernel NULL pointer dereference during probe operations, leading to system instability and potential denial of service.
This vulnerability aligns with CWE-476 which describes NULL Pointer Dereference, and represents a classic example of improper input validation in kernel space code. The attack vector leverages the uhid subsystem to emulate a Logitech receiver with padding-only DJ short output reports, making it reproducible through user-space manipulation of HID device descriptors. The KASAN (Kernel Address Sanitizer) error trace clearly identifies the problematic function logi_dj_probe at offset 0xb1, demonstrating that the issue occurs during kernel device probe operations when attempting to access memory address 0x28.
The operational impact extends beyond simple system crashes, as this vulnerability could be exploited by malicious actors to cause system instability or potentially escalate privileges through carefully crafted HID device descriptors. The fix requires implementing early rejection of zero-field reports before attempting to print field report_count information, effectively preventing the NULL pointer dereference from occurring in the first place. This mitigation aligns with ATT&CK technique T1059.001 for command and scripting interpreter usage and represents a fundamental defensive programming approach against improper resource handling in kernel drivers.
The vulnerability highlights critical security concerns in the Linux HID subsystem's handling of device descriptors, particularly in how padding fields are processed during report registration. The fix demonstrates the importance of proper validation ordering and early termination of error paths before attempting to access potentially uninitialized or invalid data structures. This issue emphasizes the need for robust defensive programming practices in kernel space where resource management failures can lead to system-wide stability issues. The resolution ensures that zero-field reports are rejected immediately during validation, preventing any subsequent dereference operations that could compromise system integrity.