{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38495", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.022Z", "datePublished": "2025-07-28T11:22:04.169Z", "dateUpdated": "2026-08-05T12:02:24.110Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:24.110Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: ensure the allocated report buffer can contain the reserved report ID\n\nWhen the report ID is not used, the low level transport drivers expect\nthe first byte to be 0. However, currently the allocated buffer not\naccount for that extra byte, meaning that instead of having 8 guaranteed\nbytes for implement to be working, we only have 7." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The undersized buffer is driven entirely by the device-supplied HID report descriptor (report->id == 0 plus a chosen report->size), and the Bluetooth HIDP transport is itself one of the consumers that writes the reserved report-ID byte into it (`data[0] = report_number` in hidp_get_raw_report()/hidp_set_raw_report()); a malicious or spoofed BR/EDR HID peripheral, or a BLE HoG device whose descriptor bluetoothd forwards into uhid, controls this from radio range. USB HID is an additional but strictly less severe (physical) path.\nAC:L - The attacker fully and deterministically controls both trigger conditions through the report descriptor — declaring an unnumbered (ID 0) report and picking a size so that hid_report_len(report)+7 lands exactly on a kmalloc slab-size boundary — with no race to win and no dependence on state the attacker cannot influence.\nPR:N - A HID peripheral needs no credentials or account on the target; the report descriptor is fetched and parsed, and feature/output reports are requested, automatically during device setup and driver probe (hid_hw_request(), mt_get_feature(), the hidinput LED worker, etc.).\nUI:N - Descriptor parsing and the subsequent report requests happen automatically during HID device enumeration and probe, with no action required from a logged-in user; an already-paired or reconnecting Bluetooth HID device reaches the code with no interaction at all.\nS:U - The under-allocation and the resulting heap corruption are both confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The buffer is one byte short of its documented contract in both directions, so on GET_REPORT paths adjacent slab bytes are mixed into data fed back through hid_report_raw_event() and into driver reads such as hid-steam's `memcpy(data, buf + 1, ...)`; per kernel scoring guidance, heap corruption of this kind is leverageable for information disclosure.\nI:H - This is an out-of-bounds heap write of attacker-influenced report data one byte past a kmalloc'd object, and because the attacker picks the report size they can align the allocation to a slab boundary so the overflow lands in the adjacent object — a classic primitive for control-flow hijacking via heap grooming.\nA:H - Corrupting the neighbouring slab object (or its metadata) readily produces oopses, slab corruption panics, and KASAN-detected slab-out-of-bounds aborts, and the attacking peripheral can retrigger it at will by reconnecting." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hid/hid-core.c" ], "versions": [ { "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f", "lessThan": "7228e36c7875e4b035374cf68ca5e44dffa596b2", "status": "affected", "versionType": "git" }, { "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f", "lessThan": "9f2892f7233a8f1320fe671d0f95f122191bfbcd", "status": "affected", "versionType": "git" }, { "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f", "lessThan": "7fa83d0043370003e9a0b46ab7ae8f53b00fab06", "status": "affected", "versionType": "git" }, { "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f", "lessThan": "d3ed1d84a84538a39b3eb2055d6a97a936c108f2", "status": "affected", "versionType": "git" }, { "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f", "lessThan": "fcda39a9c5b834346088c14b1374336b079466c1", "status": "affected", "versionType": "git" }, { "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f", "lessThan": "a262370f385e53ff7470efdcdaf40468e5756717", "status": "affected", "versionType": "git" }, { "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f", "lessThan": "a47d9d9895bad9ce0e840a39836f19ca0b2a343a", "status": "affected", "versionType": "git" }, { "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f", "lessThan": "4f15ee98304b96e164ff2340e1dfd6181c3f42aa", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hid/hid-core.c" ], "versions": [ { "version": "3.15", "status": "affected" }, { "version": "0", "lessThan": "3.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.297", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.241", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.147", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.100", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.40", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.8", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.4.297" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.10.241" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.15.190" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.1.147" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.6.100" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.12.40" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.15.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7228e36c7875e4b035374cf68ca5e44dffa596b2" }, { "url": "https://git.kernel.org/stable/c/9f2892f7233a8f1320fe671d0f95f122191bfbcd" }, { "url": "https://git.kernel.org/stable/c/7fa83d0043370003e9a0b46ab7ae8f53b00fab06" }, { "url": "https://git.kernel.org/stable/c/d3ed1d84a84538a39b3eb2055d6a97a936c108f2" }, { "url": "https://git.kernel.org/stable/c/fcda39a9c5b834346088c14b1374336b079466c1" }, { "url": "https://git.kernel.org/stable/c/a262370f385e53ff7470efdcdaf40468e5756717" }, { "url": "https://git.kernel.org/stable/c/a47d9d9895bad9ce0e840a39836f19ca0b2a343a" }, { "url": "https://git.kernel.org/stable/c/4f15ee98304b96e164ff2340e1dfd6181c3f42aa" } ], "title": "HID: core: ensure the allocated report buffer can contain the reserved report ID", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:39:03.891Z" } } ] } }