CVE-2026-43136

Vulnerability

CVE-2026-43136 is a denial-of-service vulnerability in the Linux kernel's HID-Logitech HID++ driver. The function hidpp_get_report_length() fails to check whether a HID report has any fields before accessing them. When a fake USB gadget sends a crafted HID report descriptor that defines a report structure with no valid fields, the kernel attempts to dereference a null or invalid pointer, leading to a crash.

Exploitation

An attacker with physical USB access or the ability to emulate a USB device can exploit this vulnerability. By connecting a malicious USB gadget that presents a specially crafted HID report descriptor lacking any fields, the attacker triggers the missing maxfield check in the driver. No authentication or special privileges are required beyond the ability to connect a USB device.

Impact

Successful exploitation results in a kernel crash (denial of service). The vulnerability does not appear to allow arbitrary code execution or privilege escalation; the primary impact is system instability and potential data loss from an unexpected reboot or panic.

Mitigation

The fix has been applied in the Linux kernel stable tree via commits [1], [2], [3], and [4]. Users should update to a kernel version containing the patch. No workaround is available other than applying the update or restricting physical USB access to trusted devices.