CVE-2026-64427

CVE CVE-2026-64427EUVD EUVD-2026-48771Published 2026-07-25T08:51:04.000ZLast changed 2026-08-09T18:34:57.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") added validation for the DJ short output report, but the error path dereferences rep->field[0] even when rep->maxfield is zero. Commit 8b9a097eb2fc ("HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report") made the check conditional on rep being present, but a crafted descriptor can still create report ID 0x20 with only padding output items. hid-core registers the report, ignores the padding field, and leaves rep->maxfield as zero. In that case the validation enters the rep->maxfield < 1 branch and then dereferences rep->field[0]->report_count while printing the error message, causing a NULL pointer dereference during probe. This is reproducible with uhid by emulating a Logitech receiver with a padding-only DJ short output report: BUG: KASAN: null-ptr-deref in logi_dj_probe+0xb1/0x754 [hid_logitech_dj] Read of size 4 at addr 0000000000000028 by task kworker/4:1/129 ... Call Trace: logi_dj_probe+0xb1/0x754 [hid_logitech_dj] hid_device_probe+0x329/0x3f0 [hid] really_probe+0x162/0x570 __device_attach+0x137/0x2c0 bus_probe_device+0x38/0xc0 device_add+0xa56/0xce0 hid_add_device+0x19c/0x280 [hid] uhid_device_add_worker+0x2c/0xb0 [uhid] Reject the zero-field report before printing the field report_count.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 7.1; bc3bba4656ad280267ea78cf845ab6b1d95b9fcd <2b70bebc709489d29a31ac2935aeffb8d5228395; b6a57912854e7ea36f3b270032661140cc4209cd <590cc4d782487632a52f37c2171bee1eeea29627; b6a57912854e7ea36f3b270032661140cc4209cd <7a89ad762fad53d56b7002d7ffc923a4b7f4006f; patch: 7.2-rc3; 968e84f5c0dca4960580d174500e4bbf0c45dc15 <95b3f23d632490b5eb285b9fcf7284f2ac8f9872; patch: 7.1.4; ce2a731c179df8869e1969a1b2b5b9e4e1c25f8b <80c1e18473f63fd7c6a2bc9ad6f3d0a6cc4fb500; patch: 0

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.