In the Linux kernel, the following vulnerability has been resolved:
Input: croseckeyb - fix an invalid memory access
If croseckeybregistermatrix() isn't called (due to
buttons_switches_only) in croseckeybprobe(), ckdev->idev remains
NULL. An invalid memory access is observed in croseckeybprocess()
when receiving an ECMKBPEVENTKEYMATRIX event in croseckeyb_work()
in such case.
Unable to handle kernel read from unreadable memory at virtual address 0000000000000028 ... x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: inputevent croseckeybwork blockingnotifiercallchain ecirq_thread
It's still unknown about why the kernel receives such malformed event,
in any cases, the kernel shouldn't access ckdev->idev and friends if
the driver doesn't intend to initialize them.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40263.json",
"cna_assigner": "Linux"
}