Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64427— HID: logitech-dj: Fix maxfield check in DJ short report validation

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 7.1版本存在安全漏洞，该漏洞源于HID logitech-dj的DJ短报告验证中maxfield检查缺陷，可能导致空指针取消引用。

AI Predicted 6.5 Difficulty: Moderate EPSS 0.12% · P2

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 7754ade02d0fb1caf20392baf4e02937378fd136< f3790a6af9c7f47d454225cab9dc145270e48f62 affected
2ed9638cfbf9d49bdef9b0f5ee547236c2c2f500< 1215febd644c3e16f77e0f1799d89544dd57a754 affected
eeb5ad388595ca2b6624689198a057847f3a3e19< 6f7f22a8d244c2e586b8eb61c7585784b62aea01 affected
968e84f5c0dca4960580d174500e4bbf0c45dc15< 95b3f23d632490b5eb285b9fcf7284f2ac8f9872 affected
ce2a731c179df8869e1969a1b2b5b9e4e1c25f8b< 80c1e18473f63fd7c6a2bc9ad6f3d0a6cc4fb500 affected
bc3bba4656ad280267ea78cf845ab6b1d95b9fcd< 2b70bebc709489d29a31ac2935aeffb8d5228395 affected
b6a57912854e7ea36f3b270032661140cc4209cd< 7a89ad762fad53d56b7002d7ffc923a4b7f4006f affected
b6a57912854e7ea36f3b270032661140cc4209cd< 590cc4d782487632a52f37c2171bee1eeea29627 affected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64427

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HID: logitech-dj: Fix maxfield check in DJ short report validation
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") added validation for the DJ short output report, but the error path dereferences rep->field[0] even when rep->maxfield is zero. Commit 8b9a097eb2fc ("HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report") made the check conditional on rep being present, but a crafted descriptor can still create report ID 0x20 with only padding output items. hid-core registers the report, ignores the padding field, and leaves rep->maxfield as zero. In that case the validation enters the rep->maxfield < 1 branch and then dereferences rep->field[0]->report_count while printing the error message, causing a NULL pointer dereference during probe. This is reproducible with uhid by emulating a Logitech receiver with a padding-only DJ short output report: BUG: KASAN: null-ptr-deref in logi_dj_probe+0xb1/0x754 [hid_logitech_dj] Read of size 4 at addr 0000000000000028 by task kworker/4:1/129 ... Call Trace: logi_dj_probe+0xb1/0x754 [hid_logitech_dj] hid_device_probe+0x329/0x3f0 [hid] really_probe+0x162/0x570 __device_attach+0x137/0x2c0 bus_probe_device+0x38/0xc0 device_add+0xa56/0xce0 hid_add_device+0x19c/0x280 [hid] uhid_device_add_worker+0x2c/0xb0 [uhid] Reject the zero-field report before printing the field report_count.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 7.1版本存在安全漏洞，该漏洞源于HID logitech-dj的DJ短报告验证中maxfield检查缺陷，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 7754ade02d0fb1caf20392baf4e02937378fd136 ~ f3790a6af9c7f47d454225cab9dc145270e48f62 -
Linux Linux 7.1 -

II. Public POCs for CVE-2026-64427

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64427

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64427 (8)

Same Patch Batch · Linux · 2026-07-25 · 274 CVEs total

CVE-2026-64355 9.8 CRITICAL bpf: Reject fragmented frames in devmap
CVE-2026-64459 9.8 CRITICAL tcp: restore RCU grace period in tcp_ao_destroy_sock
CVE-2026-64303 9.8 CRITICAL spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
CVE-2026-64439 9.8 CRITICAL crypto: krb5 - filter out async aead implementations at alloc
CVE-2026-64410 9.8 CRITICAL netfilter: flowtable: IPIP tunnel hardware offload is not yet support
CVE-2026-64399 9.8 CRITICAL ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
CVE-2026-64397 9.8 CRITICAL ksmbd: serialize QUERY_DIRECTORY requests per file
CVE-2026-64391 9.8 CRITICAL ksmbd: use opener credentials for ADS I/O
CVE-2026-64387 9.8 CRITICAL smb: client: fix query directory replay double-free
CVE-2026-64386 9.8 CRITICAL smb: client: fix query_info() replay double-free
CVE-2026-64385 9.8 CRITICAL smb: client: fix double-free in SMB2_ioctl() replay
CVE-2026-64383 9.8 CRITICAL smb: client: fix double-free in SMB2_flush() replay
CVE-2026-64384 9.8 CRITICAL smb: client: fix change notify replay double-free
CVE-2026-64268 9.8 CRITICAL RDMA/siw: bound Read Response placement to the RREAD length
CVE-2026-64523 9.8 CRITICAL net/handshake: Take a long-lived file reference at submit
CVE-2026-64269 9.1 CRITICAL RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
CVE-2026-64257 9.1 CRITICAL smb: client: reject overlapping data areas in SMB2 responses
CVE-2026-64319 9.1 CRITICAL nvmet-auth: validate reply message payload bounds against transfer length
CVE-2026-64320 9.1 CRITICAL nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
CVE-2026-64393 9.1 CRITICAL ksmbd: run set info with opener credentials

Showing top 20 of 274 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64427

No comments yet

Leave a comment