CVE-2021-47522

What it actually does

Null pointer dereference in HID bigbenff driver when uhid emulation provides no output reports, causing report_field to be null and triggering a kernel crash on access.

Why it matters to the business

Local users or processes can trigger denial-of-service crashes on affected Linux systems, disrupting availability of servers, desktops, or embedded devices that use HID emulation for input devices.

How an attack unfolds

An attacker with local access creates a uhid device instance emulating a bigbenff controller, omits output reports so report_field remains null, then triggers driver code paths that dereference the null pointer, resulting in a kernel panic.

How to fix it

Update the Linux kernel to a version containing the HID bigbenff null-pointer fix; rebuild and deploy the patched kernel across all affected systems; disable uhid emulation for bigbenff devices where feasible until patched.

How to confirm the fix worked

Verify kernel version against upstream commit that added the null check; attempt uhid bigbenff emulation in a test environment and confirm absence of dereference crashes; review kernel logs for prior oops signatures matching the driver.

Typical attack path

1. Obtain local user or process execution context on target Linux system
2. Use uhid interface to register a bigbenff-emulated HID device without output reports
3. Invoke driver functions that access report_field without null checks
4. Trigger kernel oops or panic to achieve denial of service

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing bigbenff, hid, or report_field null dereference; correlate with process activity creating uhid devices.

• bigbenff
• report_field
• uhid
• hid_bigben
• kernel oops: NULL pointer dereference

What your security team should do

• Prioritize kernel updates on all internet-facing or multi-user Linux hosts
• Audit systems for use of uhid-based HID emulation
• Monitor kernel logs for hid/bigbenff related faults
• Apply defense-in-depth by restricting local user access to uhid