CVE-2026-64427: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64427 Overview

CVE-2026-64427 is a NULL pointer dereference vulnerability in the Linux kernel's hid-logitech-dj driver. The flaw resides in the DJ short output report validation logic added to prevent an earlier out-of-bounds write. A crafted HID report descriptor can register report ID 0x20 with only padding output items, leaving rep->maxfield set to zero. The validation path then dereferences rep->field[0]->report_count while formatting an error message, triggering a NULL pointer dereference during probe.

Critical Impact
A local attacker able to emulate a USB HID device (for example via uhid) can crash the kernel during driver probe, resulting in denial of service.

Affected Products

Linux kernel versions containing commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write")
Linux kernel versions containing commit 8b9a097eb2fc ("HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report")
Systems with the hid_logitech_dj module loaded and uhid accessible to attackers

Discovery Timeline

2026-07-25 - CVE-2026-64427 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64427

Vulnerability Analysis

The hid-logitech-dj driver validates DJ short output reports during probe to prevent user-initiated out-of-bounds writes on report ID 0x20. The prior fix made the validation conditional on the report being present but did not verify that the report actually contained any fields. When a crafted descriptor registers report ID 0x20 composed only of padding output items, hid-core accepts the report and skips the padding, leaving rep->maxfield at zero.

The validation branch checks rep->maxfield < 1 and prints an error message that references rep->field[0]->report_count. Because rep->field[0] is uninitialized when maxfield is zero, the read at offset 0x28 faults. KASAN reports the fault as null-ptr-deref in logi_dj_probe+0xb1/0x754, occurring in the probe worker thread invoked from hid_add_device via uhid_device_add_worker.

Root Cause

The root cause is missing input validation on the maxfield count before dereferencing the field array. The error path assumes at least one field exists whenever validation fails, but a padding-only report leaves the field array empty. The fix rejects the zero-field report before formatting the diagnostic message that reads report_count.

Attack Vector

An unprivileged local user with access to /dev/uhid can emulate a Logitech Unifying receiver and supply a HID report descriptor that declares a 0x20 output report containing only padding items. When the kernel probes the emulated device, logi_dj_probe triggers the NULL pointer dereference and oopses. The result is a kernel crash, denying service to the affected system.

// No verified exploit code is published for CVE-2026-64427.
// Reproduction requires a crafted HID report descriptor delivered via uhid
// that registers report ID 0x20 with padding-only output items so that
// rep->maxfield remains zero when logi_dj_probe validates the report.

Detection Methods for CVE-2026-64427

Indicators of Compromise

Kernel oops or KASAN report referencing logi_dj_probe+0xb1/0x754 in hid_logitech_dj
BUG: KASAN: null-ptr-deref messages with a read of size 4 at address 0x0000000000000028
Unexpected uhid_device_add_worker invocations from non-administrative user sessions

Detection Strategies

Monitor dmesg and journalctl -k for null-ptr-deref faults inside hid_logitech_dj during device probe
Audit processes that open /dev/uhid and correlate with subsequent HID device registrations
Track kernel version and module load state to identify hosts running vulnerable hid-logitech-dj builds

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on repeated probe-time crashes in HID drivers
Baseline legitimate uhid consumers such as Bluetooth stacks and flag unexpected callers
Track patch state across the Linux fleet using the fixed commits 590cc4d782487632a52f37c2171bee1eeea29627 and 7a89ad762fad53d56b7002d7ffc923a4b7f4006f

How to Mitigate CVE-2026-64427

Immediate Actions Required

Apply the upstream Linux kernel patches that reject zero-field DJ short reports before dereferencing rep->field[0]
Restrict access to /dev/uhid to trusted system services and administrators
Unload hid_logitech_dj on systems that do not require Logitech Unifying receiver support

Patch Information

The fix is applied in the upstream kernel via commits 590cc4d782487632a52f37c2171bee1eeea29627 and 7a89ad762fad53d56b7002d7ffc923a4b7f4006f. The patched code rejects the zero-field report before printing the field report_count, preventing the NULL pointer dereference during probe.

Workarounds

Blacklist the hid_logitech_dj module on hosts that do not use Logitech wireless receivers
Set restrictive permissions on /dev/uhid so that only privileged processes can create emulated HID devices
Disable or remove the uhid module where user-space HID emulation is not required

bash

# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist hid_logitech_dj" | sudo tee /etc/modprobe.d/blacklist-logitech-dj.conf
sudo modprobe -r hid_logitech_dj

# Restrict /dev/uhid to root only
sudo chmod 600 /dev/uhid