Linux Kernel HID Prodikeys Null Pointer Dereference Vulnerability

A vulnerability in the Linux kernel's HID Prodikeys driver can lead to a null pointer dereference and subsequent crash. This issue arises when fake USB devices send report descriptors that bypass the input_mapping() hook, leaving the pm->input_ep82 variable null. While this problem does not occur with genuine devices, it can be exploited by simulating a fake device.

Impact

Exploitation of this vulnerability causes a kernel crash due to a null pointer dereference.

Reproduction

The vulnerability can be reproduced by using a fake USB device that sends custom report descriptors without invoking the input_mapping() hook. This can be achieved by impersonating a real device, which will result in the pm->input_ep82 variable remaining null. When the system later attempts to access this variable, a crash will occur.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been addressed.