CVE-2025-40263: Input: cros_ec_keyb - fix an invalid memory access
In the Linux kernel, the following vulnerability has been resolved:
Input: croseckeyb - fix an invalid memory access
If croseckeybregistermatrix() isn't called (due to buttonsswitchesonly) in croseckeybprobe(), ckdev->idev remains NULL. An invalid memory access is observed in croseckeybprocess() when receiving an ECMKBPEVENTKEYMATRIX event in croseckeybwork() in such case.
Unable to handle kernel read from unreadable memory at virtual address 0000000000000028 ... x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: inputevent croseckeybwork blockingnotifiercallchain ecirqthread
It's still unknown about why the kernel receives such malformed event, in any cases, the kernel shouldn't access ckdev->idev and friends if the driver doesn't intend to initialize them.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40263?
The severity of CVE-2025-40263 is categorized as medium due to the potential for invalid memory access.
How do I fix CVE-2025-40263?
To fix CVE-2025-40263, ensure that cros_ec_keyb_register_matrix() is called properly during the probe process.
What versions of the Linux kernel are affected by CVE-2025-40263?
CVE-2025-40263 affects multiple versions of the Linux kernel that include the cros_ec_keyboard driver.
What is the impact of CVE-2025-40263?
The impact of CVE-2025-40263 includes potential crashes or unexpected behavior due to invalid memory access.
Is CVE-2025-40263 being actively exploited?
As of now, there is no indication that CVE-2025-40263 is being actively exploited in the wild.