CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request
In the Linux kernel, the following vulnerability has been resolved:
HID: core: do not bypass hidhwrawrequest
hidhwrawrequest() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38494?
CVE-2025-38494 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38494?
To fix CVE-2025-38494, upgrade to the patched version of the Linux kernel provided by your distribution.
What systems are affected by CVE-2025-38494?
CVE-2025-38494 affects various versions of the Linux kernel that utilize the HID subsystem.
What type of vulnerability is CVE-2025-38494?
CVE-2025-38494 is a coding issue related to the HID (Human Interface Device) subsystem in the Linux kernel.
Can CVE-2025-38494 be exploited remotely?
CVE-2025-38494 does not represent a direct remote exploit, but it can impact systems with vulnerable kernel configurations.