CVE-2023-53015

HID: betop: check shape of output reports

State: Published
Severity: 5.5 Medium
Published: Mar 27, 2025
Updated: May 11, 2026
Reserved: Mar 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: betop: check shape of output reports

betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields. A device advertising an output report with one field and 4 report counts would pass the check but crash the kernel with a NULL pointer dereference in hid_betopff_play().

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before dbab4dba400d6ea9a9697fbbd287adbf7db1dac4Affected 52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before 7317326f685824c7c29bd80841fd18041af6bb73Affected 52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before d3065cc56221d1a5eda237e94eaf2a627b88ab79Affected 52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before 28fc6095da22dc88433d79578ae1c495ebe8ca43Affected 52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before 1a2a47b85cab50a3c146731bfeaf2d860f5344eeAffected 52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before 07bc32e53c7bd5c91472cc485231ef6274db9b76Affected 52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before 3782c0d6edf658b71354a64d60aa7a296188fc90Affected
LinuxLinux	4.0Affected before 4.0Not affected 4.14.305 through 4.14.Not affected 4.19.272 through 4.19.Not affected 5.4.231 through 5.4.Not affected 5.10.166 through 5.10.Not affected 5.15.91 through 5.15.Not affected 6.1.9 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before dbab4dba400d6ea9a9697fbbd287adbf7db1dac4Affected
52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before 7317326f685824c7c29bd80841fd18041af6bb73Affected
52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before d3065cc56221d1a5eda237e94eaf2a627b88ab79Affected
52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before 28fc6095da22dc88433d79578ae1c495ebe8ca43Affected
52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before 1a2a47b85cab50a3c146731bfeaf2d860f5344eeAffected
52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before 07bc32e53c7bd5c91472cc485231ef6274db9b76Affected
52cd7785f3cdd2724f4efb5b21dbc75d6f9ccef4 to before 3782c0d6edf658b71354a64d60aa7a296188fc90Affected

LinuxLinux

4.0Affected
before 4.0Not affected
4.14.305 through 4.14.*Not affected
4.19.272 through 4.19.*Not affected
5.4.231 through 5.4.*Not affected
5.10.166 through 5.10.*Not affected
5.15.91 through 5.15.*Not affected
6.1.9 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.