CVE-2026-97538: hwmon: (asus_rog_ryujin) Validate HID report lengths
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (asusrogryujin) Validate HID report lengths
rogryujinrawevent() parses response headers and payload fields without first checking that they are present in the received report. A short report can therefore make the driver consume uninitialized bytes from the HID transport buffer and expose them as sensor values through sysfs.
Validate the response header and the fields used by each response type before parsing them.
Affected Software
Event History
Frequently Asked Questions
Which systems are in scope for this issue?
The issue is in the Linux kernel's asus_rog_ryujin hwmon driver. Exposure requires that this driver process HID reports; the provided information does not identify other kernel components as affected.
What condition is required to trigger the vulnerable path?
The driver must receive a HID report that is shorter than the header or payload fields it attempts to parse. The provided data does not state how an attacker could cause such a report to be received.
What is the documented impact?
The driver can consume uninitialized bytes from the HID transport buffer and expose them as sensor values through sysfs. No additional impact, such as code execution or privilege escalation, is described in the provided data.