CVE-2025-38495

MEDIUM

Linux Kernel 3.15-6.15.8 - Buffer Overflow in HID Report Buffer

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, meaning that instead of having 8 guaranteed bytes for implement to be working, we only have 7.

References (10)

Core 10
Core References

Scores

CVSS v3 5.5
EPSS 0.0002
EPSS Percentile 6.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

Status published
Products (28)
debian/debian_linux 11.0
linux/Kernel 3.15.0 - 5.4.297linux
linux/Kernel 5.11.0 - 5.15.190linux
linux/Kernel 5.16.0 - 6.1.147linux
linux/Kernel 5.5.0 - 5.10.241linux
linux/Kernel 6.13.0 - 6.15.8linux
linux/Kernel 6.2.0 - 6.6.100linux
linux/Kernel 6.7.0 - 6.12.40linux
Linux/Linux < 3.15
Linux/Linux 3.15
... and 18 more
Published Jul 28, 2025
Tracked Since Feb 18, 2026