CVE-2025-21948

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: appleir: Fix potential NULL dereference at raw event handle

Syzkaller reports a NULL pointer dereference issue in input_event().

BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]

BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]

BUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline]

BUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395

Read of size 8 at addr 0000000000000028 by task syz-executor199/2949

CPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

Call Trace:

<IRQ>

__dump_stack lib/dump_stack.c:94 [inline]

dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120

kasan_report+0xd9/0x110 mm/kasan/report.c:602

check_region_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References