CVE-2025-40263

Vulnerability

In the Linux kernel's Chrome OS EC keyboard driver (drivers/input/keyboard/cros_ec_keyb.c), when the device is configured with buttons_switches_only = 1, the function cros_ec_keyb_register_matrix() is skipped during probe [1]. This leaves ckdev->idev as NULL. If an EC_MKBP_EVENT_KEY_MATRIX event is later received, the workqueue handler cros_ec_keyb_work() calls cros_ec_keyb_process() which directly uses the NULL idev pointer for input_event(), causing an invalid memory access and a kernel panic [2].

Exploitation

An attacker who can inject a malformed EC_MKBP event (for example, via a compromised or malicious embedded controller firmware) can trigger this NULL-pointer dereference from any context where the driver processes events. No special privileges are required beyond the ability to send the specific event type to the driver, which may occur during normal EC communication [2]. The crash trace shows the fault originates in input_event() called from cros_ec_keyb_work() [2].

Impact

Successful exploitation leads to a denial of service (system crash or lockup) due to a kernel NULL-pointer dereference [2]. The vulnerability does not appear to allow arbitrary code execution or privilege escalation; it is a plain read-from-NULL with no controlled data flow [2].

Mitigation

The fix adds a guard in cros_ec_keyb_process(): if ckdev->idev is NULL, the function returns early without accessing the input device [3][4]. This commit has been backported to stable kernel trees [1][3][4]. Users should apply the latest kernel updates or cherry-pick the corresponding commit for their kernel version.