CVE-2025-38494 (GCVE-0-2025-38494)
Vulnerability from cvelistv5
Published
2025-07-28 11:22
Modified
2026-08-05 12:02
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used.
References
Impacted products
Vendor Product Version
Linux Linux Version: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f
Version: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f
Version: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f
Version: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f
Version: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f
Version: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f
Version: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f
Version: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:01.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd8e8314f2ce225dade5248dcfb9e2ac0edda624",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "40e25aa7e4e0f2440c73a683ee448e41c7c344ed",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "f10923b8d32a473b229477b63f23bbd72b1e9910",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "a62a895edb2bfebffa865b5129a66e3b4287f34f",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "d18f63e848840100dbc351a82e7042eac5a28cf5",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "19d1314d46c0d8a5c08ab53ddeb62280c77698c0",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "c2ca42f190b6714d6c481dfd3d9b62ea091c946b",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: do not bypass hid_hw_raw_request\n\nhid_hw_raw_request() is actually useful to ensure the provided buffer\nand length are valid. Directly calling in the low level transport driver\nfunction bypassed those checks and allowed invalid paramto be used."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker supplies the malicious HID report descriptor through a local interface \u2014 `/dev/uhid` (UHID_CREATE2) \u2014 and triggers `hid_hw_request()` locally via device connect, an EV_LED write, or a force-feedback ioctl on `/dev/input/eventX`; no network or adjacent-network path is involved.\nAC:L - The attacker fully controls both the report descriptor that produces the degenerate `hid_report_len() == 0` value and the moment the request is issued, so the unvalidated length reaches the transport driver deterministically with no race or environmental precondition.\nPR:L - Only access to a HID char device is needed \u2014 `/dev/uhid` and `/dev/input/event*`/`hidraw` nodes are granted to the logged-in seat user via udev `uaccess` tagging on desktop and Android-class systems, and are routinely exposed inside privileged containers, so no real root in the initial namespace is required.\nUI:N - The attacker\u0027s own process creates the uhid device and issues the triggering request; `hidinput_change_resolution_multipliers()` fires the GET_REPORT automatically at device connect with no action from any other user.\nS:U - The corrupted memory and the bypassed validation are both inside the kernel\u0027s HID subsystem, managed by the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked `len == 0` causes a `size_t` underflow (`count--`) in transport handlers such as `i2c_hid_get_raw_report()` and `usbhid_get_raw_report()`, so an over-long response is copied out and then passed to `hid_input_report()` with an inflated size, exposing adjacent heap contents through input/hidraw data readable from userspace.\nI:H - The same underflow makes `i2c_hid_get_report()` memcpy up to `ihid-\u003ebufsize` bytes of device-controlled data into a 7-byte `hid_alloc_report_buf()` allocation \u2014 a controlled heap out-of-bounds write usable as a control-flow-hijack primitive; the patch additionally restores the bypassed HID-BPF request-filtering hook.\nA:H - Passing an invalid length into the low-level transport produces heap out-of-bounds reads and writes that reliably trigger KASAN reports, slab corruption, and kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:23.039Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd8e8314f2ce225dade5248dcfb9e2ac0edda624"
        },
        {
          "url": "https://git.kernel.org/stable/c/40e25aa7e4e0f2440c73a683ee448e41c7c344ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/f10923b8d32a473b229477b63f23bbd72b1e9910"
        },
        {
          "url": "https://git.kernel.org/stable/c/a62a895edb2bfebffa865b5129a66e3b4287f34f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81"
        },
        {
          "url": "https://git.kernel.org/stable/c/d18f63e848840100dbc351a82e7042eac5a28cf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/19d1314d46c0d8a5c08ab53ddeb62280c77698c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2ca42f190b6714d6c481dfd3d9b62ea091c946b"
        }
      ],
      "title": "HID: core: do not bypass hid_hw_raw_request",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38494",
    "datePublished": "2025-07-28T11:22:03.180Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:23.039Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.