CVE-2025-38557

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

HID: apple: validate feature-report field count to prevent NULL pointer dereference

A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL

pointer dereference whilst the power feature-report is toggled and sent to

the device in apple_magic_backlight_report_set(). The power feature-report

is expected to have two data fields, but if the descriptor declares one

field then accessing field[1] and dereferencing it in

apple_magic_backlight_report_set() becomes invalid

since field[1] will be NULL.

An example of a minimal descriptor which can cause the crash is something

like the following where the report with ID 3 (power report) only

references a single 1-byte field. When hid core parses the descriptor it

will encounter the final feature tag, allocate a hid_report (all members

of field[] will be zeroed out), create field structure and populate it,

increasing the maxfield to 1. The subsequent field[1] ac

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References