CVE-2026-23382

A flaw was found in the Linux kernel's Human Interface Device (HID) drivers. This vulnerability occurs when raw event callbacks are processed for an unclaimed HID device, due to missing input validation checks. A local attacker, by connecting a specially crafted HID device, could trigger a NULL dereference. This leads to a system crash, resulting in a Denial of Service (DoS).

This flaw affects multiple HID drivers that failed to add HID_CLAIMED_INPUT guards after the appleir fix. Raw event callbacks can occur for unclaimed devices, causing NULL dereferences. Physical access to connect a malicious USB HID device is required. This is a class of bugs across multiple HID drivers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.