Answer in brief
CVE-2026-64427 records a Medium severity (CVSS 5.5) vulnerability in HID: logitech-dj: Fix maxfield check in DJ short report validation. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=968e84f5c0dca4960580d174500e4bbf0c45dc15 <95b3f23d632490b5eb285b9fcf7284f2ac8f9872 || >=ce2a731c179df8869e1969a1b2b5b9e4e1c25f8b <80c1e18473f63fd7c6a2bc9ad6f3d0a6cc4fb500 || >=bc3bba4656ad280267ea78cf845ab6b1d95b9fcd <2b70bebc709489d29a31ac2935aeffb8d5228395 || >=b6a57912854e7ea36f3b270032661140cc4209cd <7a89ad762fad53d56b7002d7ffc923a4b7f4006f || >=b6a57912854e7ea36f3b270032661140cc4209cd <590cc4d782487632a52f37c2171bee1eeea29627 | 95b3f23d632490b5eb285b9fcf7284f2ac8f9872, 80c1e18473f63fd7c6a2bc9ad6f3d0a6cc4fb500, 2b70bebc709489d29a31ac2935aeffb8d5228395, 7a89ad762fad53d56b7002d7ffc923a4b7f4006f, 590cc4d782487632a52f37c2171bee1eeea29627 |
| Linux/Linuxgeneric | 7.1 | Not reported |
| Linux/Linuxgeneric | >=7754ade02d0fb1caf20392baf4e02937378fd136 <f3790a6af9c7f47d454225cab9dc145270e48f62 || >=2ed9638cfbf9d49bdef9b0f5ee547236c2c2f500 <1215febd644c3e16f77e0f1799d89544dd57a754 || >=eeb5ad388595ca2b6624689198a057847f3a3e19 <6f7f22a8d244c2e586b8eb61c7585784b62aea01 || >=968e84f5c0dca4960580d174500e4bbf0c45dc15 <95b3f23d632490b5eb285b9fcf7284f2ac8f9872 || >=ce2a731c179df8869e1969a1b2b5b9e4e1c25f8b <80c1e18473f63fd7c6a2bc9ad6f3d0a6cc4fb500 || >=bc3bba4656ad280267ea78cf845ab6b1d95b9fcd <2b70bebc709489d29a31ac2935aeffb8d5228395 || >=b6a57912854e7ea36f3b270032661140cc4209cd <7a89ad762fad53d56b7002d7ffc923a4b7f4006f || >=b6a57912854e7ea36f3b270032661140cc4209cd <590cc4d782487632a52f37c2171bee1eeea29627 | f3790a6af9c7f47d454225cab9dc145270e48f62, 1215febd644c3e16f77e0f1799d89544dd57a754, 6f7f22a8d244c2e586b8eb61c7585784b62aea01, 95b3f23d632490b5eb285b9fcf7284f2ac8f9872, 80c1e18473f63fd7c6a2bc9ad6f3d0a6cc4fb500, 2b70bebc709489d29a31ac2935aeffb8d5228395, 7a89ad762fad53d56b7002d7ffc923a4b7f4006f, 590cc4d782487632a52f37c2171bee1eeea29627 |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 9, 2026
In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") added validation for the DJ short output report, but the error path dereferences rep->field[0] even when rep->maxfield is zero. Commit 8b9a097eb2fc ("HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report") made the check conditional on rep being present, but a crafted descriptor can still create report ID 0x20 with only padding output items. hid-core registers the report, ignores the padding field, and leaves rep->maxfield as zero. In that case the validation enters the rep->maxfield < 1 branch and then dereferences rep->field[0]->report_count while printing the error message, causing a NULL pointer dereference during probe. This is reproducible with uhid by emulating a Logitech receiver with a padding-only DJ short output report: BUG: KASAN: null-ptr-deref in logi_dj_probe+0xb1/0x754 [hid_logitech_dj] Read of size 4 at addr 0000000000000028 by task kworker/4:1/129 ... Call Trace: logi_dj_probe+0xb1/0x754 [hid_logitech_dj] hid_device_probe+0x329/0x3f0 [hid] really_probe+0x162/0x570 __device_attach+0x137/0x2c0 bus_probe_device+0x38/0xc0 device_add+0xa56/0xce0 hid_add_device+0x19c/0x280 [hid] uhid_device_add_worker+0x2c/0xb0 [uhid] Reject the zero-field report before printing the field report_count.
Quoted source text, attributed separately from HOL analysis.