Linux Kernel up to 5.4.301/6.6.117/6.12.59/6.17.9 cros_ec_keyb_register_matrix initialization

Summaryinfo

A vulnerability categorized as critical has been discovered in Linux Kernel up to 5.4.301/6.6.117/6.12.59/6.17.9. Impacted is the function cros_ec_keyb_register_matrix. Such manipulation leads to initialization. This vulnerability is listed as CVE-2025-40263. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.4.301/6.6.117/6.12.59/6.17.9 and classified as critical. Affected by this issue is the function cros_ec_keyb_register_matrix. The manipulation with an unknown input leads to a initialization vulnerability. Using CWE to declare the problem leads to CWE-665. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: Input: cros_ec_keyb - fix an invalid memory access If cros_ec_keyb_register_matrix() isn't called (due to `buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains NULL. An invalid memory access is observed in cros_ec_keyb_process() when receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work() in such case. Unable to handle kernel read from unreadable memory at virtual address 0000000000000028 ... x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: input_event cros_ec_keyb_work blocking_notifier_call_chain ec_irq_thread It's still unknown about why the kernel receives such malformed event, in any cases, the kernel shouldn't access `ckdev->idev` and friends if the driver doesn't intend to initialize them.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2025-40263 since 04/16/2025. The exploitation is known to be difficult. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/04/2026).

The vulnerability scanner Nessus provides a plugin with the ID 277512 (Linux Distros Unpatched Vulnerability : CVE-2025-40263), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.4.302, 6.6.118, 6.12.60 or 6.17.10 eliminates this vulnerability. Applying the patch 7bfd959187f2c7584bb43280bbc7b2846e7a5085/9cf59f4724a9ee06ebb06c76b8678ac322e850b7/6d81068685154535af06163eb585d6d9663ec7ec/2d251c15c27e2dd16d6318425d2f7260cbd47d39/e08969c4d65ac31297fcb4d31d4808c789152f68 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (277512), EUVD (EUVD-2025-201194) and CERT Bund (WID-SEC-2025-2747). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Debian Linux
• Google Cloud Platform
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source Linux Kernel
• RESF Rocky Linux
• Microsoft Azure Linux

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.4.301
• 6.6.117
• 6.12.0
• 6.12.1
• 6.12.2
• 6.12.3
• 6.12.4
• 6.12.5
• 6.12.6
• 6.12.7
• 6.12.8
• 6.12.9
• 6.12.10
• 6.12.11
• 6.12.12
• 6.12.13
• 6.12.14
• 6.12.15
• 6.12.16
• 6.12.17
• 6.12.18
• 6.12.19
• 6.12.20
• 6.12.21
• 6.12.22
• 6.12.23
• 6.12.24
• 6.12.25
• 6.12.26
• 6.12.27
• 6.12.28
• 6.12.29
• 6.12.30
• 6.12.31
• 6.12.32
• 6.12.33
• 6.12.34
• 6.12.35
• 6.12.36
• 6.12.37
• 6.12.38
• 6.12.39
• 6.12.40
• 6.12.41
• 6.12.42
• 6.12.43
• 6.12.44
• 6.12.45
• 6.12.46
• 6.12.47
• 6.12.48
• 6.12.49
• 6.12.50
• 6.12.51
• 6.12.52
• 6.12.53
• 6.12.54
• 6.12.55
• 6.12.56
• 6.12.57
• 6.12.58
• 6.12.59
• 6.17.0
• 6.17.1
• 6.17.2
• 6.17.3
• 6.17.4
• 6.17.5
• 6.17.6
• 6.17.7
• 6.17.8
• 6.17.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion