{
"schemaVersion": 1,
"attribution": [
{
"source": "CISA Known Exploited Vulnerabilities",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"licence": "US government work"
},
{
"source": "GitHub Advisory Database",
"url": "https://github.com/advisories",
"licence": "CC BY 4.0"
},
{
"source": "Have I Been Pwned",
"url": "https://haveibeenpwned.com/",
"licence": "CC BY 4.0"
},
{
"source": "CVE Program (CVE records)",
"url": "https://www.cve.org/Legal/TermsOfUse",
"licence": "CVE Terms of Use",
"notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
"terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
},
{
"source": "FIRST EPSS",
"url": "https://www.first.org/epss/",
"licence": "free to use; FIRST requests attribution"
}
],
"record": {
"id": "CVE-2025-21948",
"sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-21948",
"idYear": 2025,
"status": "PUBLISHED",
"publishedAt": "2025-04-01T15:41:09.949Z",
"updatedAt": "2026-05-11T21:09:38.330Z",
"importedAt": "2026-10-24T01:57:29.455Z",
"snapshot": {
"id": "cve_2026-10-24_midnight_baseline",
"at": "2026-10-24T00:00:00.000Z",
"source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
},
"facts": {
"title": "HID: appleir: Fix potential NULL dereference at raw event handle",
"summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appleir: Fix potential NULL dereference at raw event handle\n\nSyzkaller reports a NULL pointer dereference issue in input_event().\n\nBUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]\nBUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\nBUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline]\nBUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395\nRead of size 8 at addr 0000000000000028 by task syz-executor199/2949\n\nCPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n kasan_report+0xd9/0x110 mm/kasan/report.c:602\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189\n instrument_atomic_read include/linux/instrumented.h:68 [inline]\n _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\n is_event_supported drivers/input/input.c:67 [inline]\n input_event+0x42/0xa0 drivers/input/input.c:395\n input_report_key include/linux/input.h:439 [inline]\n key_down drivers/hid/hid-appleir.c:159 [inline]\n appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232\n __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111\n hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484\n __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650\n usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734\n dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993\n __run_hrtimer kernel/time/hrtimer.c:1739 [inline]\n __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803\n hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820\n handle_softirqs+0x206/0x8d0 kernel/softirq.c:561\n __do_softirq kernel/softirq.c:595 [inline]\n invoke_softirq kernel/softirq.c:435 [inline]\n __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662\n irq_exit_rcu+0x9/0x30 kernel/softirq.c:678\n instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]\n sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049\n \n \n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702\n __mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185\n add_timer+0x62/0x90 kernel/time/timer.c:1295\n schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98\n usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645\n usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784\n hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl fs/ioctl.c:892 [inline]\n __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n\nThis happens due to the malformed report items sent by the emulated device\nwhich results in a report, that has no fields, being added to the report list.\nDue to this appleir_input_configured() is never called, hidinput_connect()\nfails which results in the HID_CLAIMED_INPUT flag is not being set. However,\nit does not make appleir_probe() fail and lets the event callback to be\ncalled without the associated input device.\n\nThus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook\nearly if the driver didn't claim any input_dev for some reason. Moreover,\nsome other hid drivers accessing input_dev in their event callbacks do have\nsimilar checks, too.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
"affected": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"versions": [
{
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"status": "affected",
"versionType": "git",
"lessThan": "6db423b00940b05df2a1265d3c7eabafe9f1734c"
},
{
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"status": "affected",
"versionType": "git",
"lessThan": "0df1ac8ee417ad76760ff076faa4518a4d861894"
},
{
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"status": "affected",
"versionType": "git",
"lessThan": "b1d95d733cd6e74f595653daddcfc357bea461e8"
},
{
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"status": "affected",
"versionType": "git",
"lessThan": "8d39eb8c5e14f2f0f441eed832ef8a7b654e6fee"
},
{
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"status": "affected",
"versionType": "git",
"lessThan": "fc69e2c3219d433caabba4b5d6371ba726a4b37f"
},
{
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"status": "affected",
"versionType": "git",
"lessThan": "d335fce8b88b2353f4bb20c631698e20384e3610"
},
{
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"status": "affected",
"versionType": "git",
"lessThan": "68cdf6710f228dfd74f66ec61fbe636da2646a73"
},
{
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"status": "affected",
"versionType": "git",
"lessThan": "2ff5baa9b5275e3acafdf7f2089f74cccb2f38d1"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"versions": [
{
"version": "3.10",
"status": "affected"
},
{
"version": "0",
"status": "unaffected",
"versionType": "semver",
"lessThan": "3.10"
},
{
"version": "5.4.291",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"version": "5.10.235",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"version": "5.15.179",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"version": "6.1.131",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"version": "6.6.83",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"version": "6.12.19",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"version": "6.13.7",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.13.*"
},
{
"version": "6.14",
"status": "unaffected",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
]
}
]
}
}
}