CVE-2026-23382: Linux Kernel HID驱动空指针拒绝服务漏洞

/* * PoC Concept: Triggering HID raw_event without claimed input * This simulates the logic flow causing the NULL pointer dereference. */ struct hid_device *hdev; // Assume device is connected but not fully claimed yet void vulnerable_raw_event(struct hid_device *hdev, struct hid_report *report, u8 *data, int size) { struct input_dev *input; // VULNERABILITY: Missing check for HID_CLAIMED_INPUT // The driver assumes 'input' is valid. // input = hid_get_drvdata(hdev); // If the device is not claimed, 'input' might be NULL. if (input == NULL) { // This leads to Kernel Oops / Panic // panic(NULL pointer dereference); } // Attempting to use the input device leads to the crash input_event(input, EV_KEY, KEY_A, 1); input_sync(input); } /* * Fix: Add guard before accessing input device * if (test_bit(HID_CLAIMED_INPUT, &hdev->claimed)) { * // safe to process * } */