Linux Kernel NULL Pointer Dereference Vulnerability in HID AppleIR Driver

A NULL pointer dereference vulnerability has been identified in the Linux kernel's HID AppleIR driver. This issue arises when the driver processes malformed report items from an emulated device, leading to a report with no fields being added to the report list. Consequently, the event callback is invoked without an associated input device, causing a NULL pointer dereference in the input_event function. The vulnerability affects Linux kernel versions through 6.13.0-rc4.

Impact

Exploitation of this vulnerability leads to a NULL pointer dereference, causing a kernel crash.

Reproduction

The vulnerability can be reproduced by using the HID AppleIR driver with an emulated device that sends malformed report items, creating a report without fields. This triggers the event callback without a corresponding input device, resulting in a NULL pointer dereference.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed.