Invalid Memory Access in Linux Kernel Cros EC Keyboard Driver

CVE-2025-40263

What is CVE-2025-40263?

The Linux kernel's cros_ec_keyb driver contains a vulnerability where an invalid memory access occurs if the initialization function cros_ec_keyb_register_matrix() is not called. This issue arises when the driver receives an EC_MKBP_EVENT_KEY_MATRIX event without proper initialization, resulting in a failure to correctly handle the kernel's read operation from a null memory address. This vulnerability could potentially lead to system instability or exposure to further attacks, as the kernel accesses members that should remain uninitialized.

References