CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
In the Linux kernel, the following vulnerability has been resolved:
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhidparse()
Update struct hiddescriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 specification. Note: the kernel currently does not parse any optional HID class descriptors, only the mandatory report descriptor.
Update all references to member element desc[0] to rptdesc.
Add test to verify bLength and bNumDescriptors values are valid.
Replace the for loop with direct access to the mandatory HID class descriptor member for the report descriptor. This eliminates the possibility of getting an out-of-bounds fault.
Add a warning message if the HID descriptor contains any unsupported optional HID class descriptors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Add a warning message when the HID descriptor contains unsupported optional HID class descriptors.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38103?
CVE-2025-38103 has been classified with a severity level that may allow potential denial of service due to an out-of-bounds bug.
How do I fix CVE-2025-38103?
To fix CVE-2025-38103, update the Linux kernel to a version that includes the patch addressing the vulnerability.
Which versions of the Linux kernel are affected by CVE-2025-38103?
CVE-2025-38103 affects multiple versions of the Linux kernel prior to the release of patches that eliminate the vulnerability.
What components are impacted by CVE-2025-38103?
CVE-2025-38103 primarily impacts the HID subsystem specifically related to USB Human Interface Devices within the Linux kernel.
Is CVE-2025-38103 being actively exploited in the wild?
As of now, there are no confirmed reports of CVE-2025-38103 being actively exploited in the wild.