CVE-2025-38557

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.15.0 #31

Description: A flaw exists in the Linux kernel related to Human Interface Devices (HID) with the APPLE MAGIC BACKLIGHT quirk. A malicious HID device can trigger a NULL pointer dereference within the apple magic backlight report set() function when toggling the power feature-report. This occurs because the function expects two data fields in the power feature-report, but may encounter a descriptor declaring only one field, leading to an invalid memory access when attempting to dereference field[1]. The issue is triggered by a specific descriptor configuration where the report with ID 3 (power report) references only a single 1-byte field.

Recommendations: Update to Linux kernel version 6.15.0 #31 or later.