CVE-2025-39806: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
HID: multitouch: fix slab out-of-bounds access in mtreportfixup()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1Fixed in 7.3.3-1 - Compensating control
Modify HID multitouch mt_report_fixup() to verify that the report descriptor size is at least 608 bytes before accessing byte offset 607.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39806?
CVE-2025-39806 has been classified as a high severity vulnerability due to the potential for slab out-of-bounds access.
How do I fix CVE-2025-39806?
To fix CVE-2025-39806, update your Linux kernel to a version that includes the patch addressing this vulnerability.
What causes the vulnerability CVE-2025-39806?
CVE-2025-39806 is caused by a malicious HID device that can trigger slab out-of-bounds access in the mt_report_fixup() function by passing a report descriptor smaller than 607 bytes.
Which versions of the Linux Kernel are affected by CVE-2025-39806?
CVE-2025-39806 affects Linux Kernel versions prior to 607.
Is CVE-2025-39806 related to HID devices?
Yes, CVE-2025-39806 specifically relates to vulnerabilities triggered by malicious HID devices.