CVE-2026-23382: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23382 is a NULL pointer dereference vulnerability in the Linux kernel's HID (Human Interface Device) subsystem, caused by missing HID_CLAIMED_INPUT guards in multiple HID driver raw_event callbacks. When a broken or malicious USB HID device is connected, affected drivers can dereference a NULL pointer, resulting in a kernel crash. The vulnerability was disclosed on March 25, 2026, and affects Linux kernel versions from 2.6.35.1 through 7.0-rc2 across multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-414 (Missing Lock Check). In commit 2ff5baa9b527, the hid-appleir driver was fixed to guard its raw_event callback with an HID_CLAIMED_INPUT check, preventing crashes when a HID device has not yet been "claimed" by a driver. However, numerous other in-tree HID drivers omitted this same guard, leaving them vulnerable to the same NULL dereference if a raw event callback fires before the device is claimed. An attacker with physical access can connect a specially crafted or broken USB HID device to trigger the unguarded code path (Red Hat CVE, Feedly).

Successful exploitation results in a kernel panic (system crash), causing a complete denial of service on the affected host. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The affected scope spans a wide range of Linux kernel versions used across servers, desktops, and embedded systems, but exploitation requires local physical access to connect a USB device, limiting the practical blast radius (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of writing. The vulnerability requires physical access to the target system to connect a malicious or broken USB HID device, significantly raising the exploitation barrier. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

• Logs: Kernel panic messages in /var/log/kern.log or dmesg output referencing a NULL pointer dereference in a HID driver raw_event callback (e.g., BUG: kernel NULL pointer dereference with a stack trace involving HID subsystem functions).
• System Behavior: Unexpected system reboots or kernel oops events coinciding with the physical connection of a USB HID device.
• Hardware Events: USB device connection events logged in dmesg (e.g., usb X-Y: new full-speed USB device) immediately preceding a kernel crash.

Patches have been released across all affected stable kernel branches. Users should upgrade to the following fixed versions: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc3 (or later). Distribution-specific updates are available from Red Hat, SUSE (SUSE-SU-2026:1668-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Debian, Amazon Linux (ALAS2KERNEL-5.10-2026-118), and openSUSE. As a workaround where patching is not immediately possible, restrict physical access to USB ports or implement USB device allowlisting/port disabling policies to prevent unauthorized HID device connections (Red Hat CVE, Feedly).