high7.8
CVE-2025-38494
In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to ensu…
Impact
In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linux | Linux Kernel | from 3.15 before 5.4.297 from 5.5 before 5.10.241 from 5.11 before 5.15.190 from 5.16 before 6.1.147 from 6.2 before 6.6.100 from 6.7 before 6.12.40 |
| Debian | Debian Linux | Version 11.0 |
References
- NVD record
- CVE.org record
- https://git.kernel.org/stable/c/0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81
- https://git.kernel.org/stable/c/19d1314d46c0d8a5c08ab53ddeb62280c77698c0
- https://git.kernel.org/stable/c/40e25aa7e4e0f2440c73a683ee448e41c7c344ed
- https://git.kernel.org/stable/c/a62a895edb2bfebffa865b5129a66e3b4287f34f
- https://git.kernel.org/stable/c/c2ca42f190b6714d6c481dfd3d9b62ea091c946b
- https://git.kernel.org/stable/c/d18f63e848840100dbc351a82e7042eac5a28cf5
- https://git.kernel.org/stable/c/dd8e8314f2ce225dade5248dcfb9e2ac0edda624
- https://git.kernel.org/stable/c/f10923b8d32a473b229477b63f23bbd72b1e9910
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html