CVE-2025-21948 is a vulnerability identified in the Linux kernel specifically affecting the HID (Human Interface Device) subsystem, more precisely the appleir driver which handles Apple infrared remote controls. The issue arises from a NULL pointer dereference in the input_event() function due to malformed HID report items sent by an emulated device. These malformed reports contain no fields and are erroneously added to the report list. This leads to the appleir_input_configured() function not being called, causing the hidinput_connect() function to fail. Consequently, the HID_CLAIMED_INPUT flag is not set, but the appleir_probe() function does not fail, allowing event callbacks to be invoked without an associated input device. This results in a NULL pointer dereference when the event callback attempts to access the non-existent input device, causing a kernel crash. The vulnerability was discovered through fuzzing with Syzkaller by the Linux Verification Center. The root cause is a lack of proper validation and checks for the HID_CLAIMED_INPUT flag before processing input events in the appleir driver. Similar HID drivers have safeguards that appleir lacked. The fix involves adding a check for the HID_CLAIMED_INPUT flag to exit early from the event hook if no input device was claimed, preventing the NULL dereference. This vulnerability affects Linux kernel versions around 6.13.0-rc4 and potentially other versions using the affected appleir driver code. It is a denial-of-service (DoS) type flaw that can be triggered by sending crafted HID reports from an emulated or malicious USB HID device, causing the kernel to crash due to the NULL pointer dereference. No evidence of exploitation in the wild has been reported to date, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily of denial-of-service attacks on Linux-based systems that use the affected kernel versions and have the appleir driver enabled. Systems that accept USB HID devices, including virtualized environments or cloud instances that emulate USB devices, could be targeted by attackers to cause kernel panics and system crashes, leading to service disruptions. This could impact critical infrastructure, enterprise servers, and workstations running Linux kernels with the vulnerable appleir driver. Although the vulnerability does not directly allow privilege escalation or remote code execution, the resulting instability and downtime could affect business continuity, especially in sectors relying heavily on Linux servers such as finance, telecommunications, and public services. The vulnerability is less likely to impact desktop users unless they use Apple infrared remote devices or similar HID devices. The lack of known exploits reduces immediate risk, but the ease of triggering a kernel crash via crafted USB HID reports means attackers with physical or virtual device access could exploit it. European organizations with strict uptime and availability requirements should prioritize patching to avoid potential denial-of-service conditions.

1. Apply the official Linux kernel patches that address CVE-2025-21948 as soon as they become available from trusted sources or Linux distribution vendors. 2. If patching immediately is not feasible, consider disabling or blacklisting the appleir driver module if it is not required in your environment to prevent the vulnerable code from being executed. 3. Implement strict USB device control policies to restrict or monitor the connection of unknown or untrusted USB HID devices, especially in sensitive or critical systems. 4. In virtualized or cloud environments, audit and control emulated USB device configurations to prevent injection of malformed HID reports. 5. Employ kernel crash monitoring and alerting to detect and respond quickly to any kernel panics that may indicate exploitation attempts. 6. Maintain updated inventories of Linux kernel versions in use and track vendor advisories for timely patch deployment. 7. Conduct internal penetration testing or fuzzing on Linux systems with HID drivers to proactively identify similar issues.