CVE-2026-43136 Overview
CVE-2026-43136 is a Linux kernel vulnerability in the logitech-hidpp HID driver. The flaw resides in hidpp_get_report_length(), which fails to validate the maxfield count of a HID report before dereferencing field data. A malicious USB device can present a crafted HID report descriptor that defines a report structure containing zero fields, triggering a kernel crash when the driver processes it.
Critical Impact
A fake USB gadget with attacker-controlled HID descriptors can crash the Linux kernel, producing a local denial of service on any system with the logitech-hidpp driver loaded.
Affected Products
- Linux kernel versions containing the logitech-hidpp HID driver prior to the patches referenced in 1547d41, 1acb281, 2dc023d, 7f59999, ae81fac, b74bf7d, f1ceaaf, and fb1725c
- Distributions shipping the affected kernel with HID-PP support compiled or modular
- Systems exposed to untrusted USB peripherals or USB gadget emulators
Discovery Timeline
- 2026-05-06 - CVE CVE-2026-43136 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43136
Vulnerability Analysis
The Linux HID subsystem parses report descriptors supplied by USB devices to determine the structure of input, output, and feature reports. The logitech-hidpp driver implements hidpp_get_report_length() to compute the byte length of a given HID-PP report by inspecting the first field of the report and reading its report_count and report_size.
The function assumed that any matched report contains at least one field. When a USB device presents a report descriptor that defines a report with maxfield == 0, the driver dereferences report->field[0] on a zero-length array, producing a null pointer dereference and a kernel oops. This is an instance of [CWE-476] null pointer dereference leading to denial of service.
Because USB gadget frameworks allow software-defined peripherals, an attacker with physical access or control over a USB-attached device, including emulated gadgets running on a paired host, can deliver the malformed descriptor.
Root Cause
The root cause is missing input validation in hidpp_get_report_length(). The driver trusted that a report matching its expected ID would have a populated field array. The fix adds an explicit check on report->maxfield and returns an error when no fields are present, preventing the dereference.
Attack Vector
Exploitation requires the attacker to introduce a HID device whose report descriptor declares a report containing zero fields. Practical delivery paths include a malicious USB peripheral, a USB/IP connection, or a programmable device such as a Raspberry Pi or BadUSB-class board running a custom USB gadget. When the kernel binds the device to logitech-hidpp and invokes hidpp_get_report_length(), the kernel crashes. The impact is denial of service rather than code execution because the dereference targets unmapped memory.
No verified public exploit code is available. The vulnerability mechanism is described in the upstream commit messages.
Detection Methods for CVE-2026-43136
Indicators of Compromise
- Kernel oops or panic messages referencing hidpp_get_report_length or logitech-hidpp in dmesg or /var/log/kern.log
- Unexpected USB device enumeration events claiming Logitech vendor or HID-PP capability followed by a kernel fault
- System reboots correlated with insertion of unknown USB peripherals
Detection Strategies
- Monitor kernel ring buffer output for BUG: kernel NULL pointer dereference entries with logitech-hidpp in the call trace
- Audit udev events for HID devices binding to the hidpp driver from non-corporate vendor IDs
- Correlate USB device insertion telemetry with kernel crash reports collected by kdump or systemd-coredump
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on HID driver oops signatures
- Track USB device insertions on production servers, kiosks, and shared workstations where physical access is available
- Review crash dumps after unexpected reboots on systems handling untrusted USB peripherals
How to Mitigate CVE-2026-43136
Immediate Actions Required
- Apply the upstream Linux kernel patches identified by commits 1547d41, 1acb281, 2dc023d, 7f59999, ae81fac, b74bf7d, f1ceaaf, and fb1725c once shipped by your distribution
- Update to the latest stable kernel package provided by your Linux vendor for the affected branch
- Restrict physical USB access on servers and shared endpoints until patched
Patch Information
The fix adds a guard in hidpp_get_report_length() that checks report->maxfield and returns an error when the report has no fields. The change is distributed across multiple stable branches. See the upstream commits: Linux Kernel Commit 1547d41, Linux Kernel Commit 1acb281, Linux Kernel Commit 2dc023d, Linux Kernel Commit 7f59999, Linux Kernel Commit ae81fac, Linux Kernel Commit b74bf7d, Linux Kernel Commit f1ceaaf, and Linux Kernel Commit fb1725c
Workarounds
- Blacklist the hid_logitech_hidpp module on systems that do not require Logitech HID-PP devices using /etc/modprobe.d/
- Enforce USB device allowlisting with USBGuard to block unknown HID descriptors before driver binding
- Disable unused USB ports through BIOS or kernel parameters on servers and unattended workstations
# Blacklist the affected driver on systems without Logitech HID-PP peripherals
echo "blacklist hid_logitech_hidpp" | sudo tee /etc/modprobe.d/blacklist-hidpp.conf
sudo update-initramfs -u
# Or restrict USB device binding with USBGuard
sudo apt install usbguard
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
