Skip to main content

Linux Kernel CVE-2025-38495

MEDIUM
2025-07-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux Information Disclosure Debian Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector and low privilege required since HID subsystem access needs authenticated shell; impact is purely availability via kernel crash with no C/I exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
6.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:45 vuln.today
CVE Published
Jul 28, 2025 - 12:15 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

HID: core: ensure the allocated report buffer can contain the reserved report ID

When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, meaning that instead of having 8 guaranteed bytes for implement to be working, we only have 7.

AnalysisAI

Buffer under-allocation in the Linux kernel HID (Human Interface Device) core subsystem allows a local low-privileged user to cause a kernel denial of service. When HID report IDs are not used, the transport layer expects the first byte to be 0x00 as a placeholder, but the allocated report buffer fails to account for this reserved byte - yielding only 7 usable bytes instead of 8. No active exploitation has been identified (not in CISA KEV; EPSS at 0.20%, 10th percentile), and impact is limited to availability with no confidentiality or integrity exposure.

Technical ContextAI

The Linux kernel HID subsystem (drivers/hid/hid-core.c) manages communication with USB, Bluetooth, and I2C Human Interface Devices such as keyboards, mice, and gamepads. HID reports are structured data packets; the protocol mandates a Report ID as the first byte. When a device does not use report IDs, the spec requires the first byte to be 0x00 as a reserved placeholder so that low-level transport drivers can operate on a guaranteed minimum buffer size. The root cause is an off-by-one error in buffer length calculation (functionally equivalent to CWE-131: Incorrect Calculation of Buffer Size) - the allocation does not reserve the extra byte for this placeholder, leaving transport drivers with a 7-byte buffer where 8 bytes are assumed. Affected CPE entries span multiple Linux kernel stable branches plus pre-release 6.16-rc1 through 6.16-rc3 (cpe:2.3:o:linux:linux_kernel:6.16:rc1-rc3:*:*:*:*:*:*). Debian Linux (including LTS) is confirmed affected per October 2025 announcement.

RemediationAI

Upstream-released patch is available via vendor (Linux kernel stable tree), with eight distinct stable-branch commits provided: https://git.kernel.org/stable/c/4f15ee98304b96e164ff2340e1dfd6181c3f42aa, 7228e36c7875, 7fa83d004337, 9f2892f7233a, a262370f385e, a47d9d9895ba, d3ed1d84a845, and fcda39a9c5b8. Administrators should update to the patched kernel version for their respective stable branch as distributed by their Linux distribution. Debian users should apply the packages announced in the October 2025 LTS advisory. No specific patched release version number is independently confirmed from the available data beyond commit references; consult your distribution's security tracker for the exact package version. If immediate patching is not possible, restricting unprivileged user access to HID devices via udev rules or disabling the hid kernel module (rmmod hid) can limit exposure, though the latter will disable all HID input devices and is only suitable for headless server environments.

More in Debian Linux

View all
CVE-2021-44228 CRITICAL POC
10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2022-30333 HIGH POC
7.5 May 09

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2018-7602 CRITICAL POC
9.8 Jul 19

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2026-24061 CRITICAL POC
9.8 Jan 21

GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.6.17.8.103 Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.44 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.27 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.67 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.29 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.76 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.14 Affected
Container suse/sle-micro-rancher/5.2:latest Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-2-BYOS-GCE Affected

Share

CVE-2025-38495 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy