{"id":"CVE-2026-64427","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-dj: Fix maxfield check in DJ short report validation\n\nCommit b6a57912854e (\"HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT\nrelated user initiated OOB write\"…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-dj: Fix maxfield check in DJ short report validation\n\nCommit b6a57912854e (\"HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT\nrelated user initiated OOB write\"…","severity":"none","published":"2026-07-25","updated":"2026-08-09","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64427","references":[{"url":"https://git.kernel.org/stable/c/2b70bebc709489d29a31ac2935aeffb8d5228395","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/590cc4d782487632a52f37c2171bee1eeea29627","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a89ad762fad53d56b7002d7ffc923a4b7f4006f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/80c1e18473f63fd7c6a2bc9ad6f3d0a6cc4fb500","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/95b3f23d632490b5eb285b9fcf7284f2ac8f9872","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00123,"epssPercentile":0.02348,"ingestedAt":"2026-08-09T19:34:41.234Z","slug":"CVE-2026-64427","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-dj: Fix maxfield check in DJ short report validation\n\nCommit b6a57912854e (\"HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT\nrelated user initiated OOB write\") added validation for the DJ short\noutput report, but the error path dereferences rep->field[0] even when\nrep->maxfield is zero.\n\nCommit 8b9a097eb2fc (\"HID: logitech-dj: fix wrong detection of bad\nDJ_SHORT output report\") made the check conditional on rep being present,\nbut a crafted descriptor can still create report ID 0x20 with only padding\noutput items. hid-core registers the report, ignores the padding field,\nand leaves rep->maxfield as zero.\n\nIn that case the validation enters the rep->maxfield < 1 branch and then\ndereferences rep->field[0]->report_count while printing the error message,\ncausing a NULL pointer dereference during probe. This is reproducible with\nuhid by emulating a Logitech receiver with a padding-only DJ short output\nreport:\n\n  BUG: KASAN: null-ptr-deref in logi_dj_probe+0xb1/0x754 [hid_logitech_dj]\n  Read of size 4 at addr 0000000000000028 by task kworker/4:1/129\n  ...\n  Call Trace:\n   logi_dj_probe+0xb1/0x754 [hid_logitech_dj]\n   hid_device_probe+0x329/0x3f0 [hid]\n   really_probe+0x162/0x570\n   __device_attach+0x137/0x2c0\n   bus_probe_device+0x38/0xc0\n   device_add+0xa56/0xce0\n   hid_add_device+0x19c/0x280 [hid]\n   uhid_device_add_worker+0x2c/0xb0 [uhid]\n\nReject the zero-field report before printing the field report_count.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}