The vulnerability exists in the Linux kernel's HID prodikeys driver, where counterfeit USB devices can provide custom report descriptors that bypass the input_mapping() hook. Consequently, the pm->input_ep82 pointer remains NULL and is later dereferenced, resulting in a kernel crash. This flaw represents a null pointer dereference and lack of validation on USB descriptors and is coded as CWE-476.

All Linux kernel installations that include the prodikeys HID driver before the recent fix are affected. Vendor and version details are not explicitly listed, but the commits in the references show the issue was patched during 2026. Administrators should verify the presence of the commit(s) or apply a kernel version that contains the fix.

The CVSS score is 7.0 and EPSS is unavailable, but the flaw can be triggered by any user who can supply a malicious USB device, making it a local denial-of-service vulnerability. The KEV indicator is not listed, indicating no confirmed exploitation yet. The attack vector is physical or local access to the USB interface, with impact limited to crashing the system.