{"id":"DEBIAN-CVE-2025-21948","details":"In the Linux kernel, the following vulnerability has been resolved:  HID: appleir: Fix potential NULL dereference at raw event handle  Syzkaller reports a NULL pointer dereference issue in input_event().  BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline] BUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395 Read of size 8 at addr 0000000000000028 by task syz-executor199/2949  CPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace:  \u003cIRQ\u003e  __dump_stack lib/dump_stack.c:94 [inline]  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120  kasan_report+0xd9/0x110 mm/kasan/report.c:602  check_region_inline mm/kasan/generic.c:183 [inline]  kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189  instrument_atomic_read include/linux/instrumented.h:68 [inline]  _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]  is_event_supported drivers/input/input.c:67 [inline]  input_event+0x42/0xa0 drivers/input/input.c:395  input_report_key include/linux/input.h:439 [inline]  key_down drivers/hid/hid-appleir.c:159 [inline]  appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232  __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111  hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484  __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650  usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734  dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993  __run_hrtimer kernel/time/hrtimer.c:1739 [inline]  __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803  hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820  handle_softirqs+0x206/0x8d0 kernel/softirq.c:561  __do_softirq kernel/softirq.c:595 [inline]  invoke_softirq kernel/softirq.c:435 [inline]  __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662  irq_exit_rcu+0x9/0x30 kernel/softirq.c:678  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]  sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049  \u003c/IRQ\u003e  \u003cTASK\u003e  asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702  __mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185  add_timer+0x62/0x90 kernel/time/timer.c:1295  schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98  usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645  usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784  hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794  vfs_ioctl fs/ioctl.c:51 [inline]  __do_sys_ioctl fs/ioctl.c:906 [inline]  __se_sys_ioctl fs/ioctl.c:892 [inline]  __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f  \u003c/TASK\u003e  This happens due to the malformed report items sent by the emulated device which results in a report, that has no fields, being added to the report list. Due to this appleir_input_configured() is never called, hidinput_connect() fails which results in the HID_CLAIMED_INPUT flag is not being set. However, it  does not make appleir_probe() fail and lets the event callback to be called without the associated input device.  Thus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook early if the driver didn't claim any input_dev for some reason. Moreover, some other hid drivers accessing input_dev in their event callbacks do have similar checks, too.  Found by Linux Verification Center (linuxtesting.org) with Syzkaller.","modified":"2026-09-01T16:06:10.513646897Z","published":"2025-04-01T16:15:25.933Z","upstream":["CVE-2025-21948"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21948"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.133-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21948.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.19-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21948.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.19-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21948.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}