Riskcovery

CVE-2025-38494

HID: core: do not bypass hid_hw_raw_request

State
Published
Severity
7.8 High
Published
Jul 28, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: do not bypass hid_hw_raw_request

hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 4fa5a7f76cc7b6ac87f57741edd2b124851d119f to before dd8e8314f2ce225dade5248dcfb9e2ac0edda624Affected
  • 4fa5a7f76cc7b6ac87f57741edd2b124851d119f to before 40e25aa7e4e0f2440c73a683ee448e41c7c344edAffected
  • 4fa5a7f76cc7b6ac87f57741edd2b124851d119f to before f10923b8d32a473b229477b63f23bbd72b1e9910Affected
  • 4fa5a7f76cc7b6ac87f57741edd2b124851d119f to before a62a895edb2bfebffa865b5129a66e3b4287f34fAffected
  • 4fa5a7f76cc7b6ac87f57741edd2b124851d119f to before 0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81Affected
  • 4fa5a7f76cc7b6ac87f57741edd2b124851d119f to before d18f63e848840100dbc351a82e7042eac5a28cf5Affected
  • 4fa5a7f76cc7b6ac87f57741edd2b124851d119f to before 19d1314d46c0d8a5c08ab53ddeb62280c77698c0Affected
  • 4fa5a7f76cc7b6ac87f57741edd2b124851d119f to before c2ca42f190b6714d6c481dfd3d9b62ea091c946bAffected
LinuxLinux
  • 3.15Affected
  • before 3.15Not affected
  • 5.4.297 through 5.4.*Not affected
  • 5.10.241 through 5.10.*Not affected
  • 5.15.190 through 5.15.*Not affected
  • 6.1.147 through 6.1.*Not affected
  • 6.6.100 through 6.6.*Not affected
  • 6.12.40 through 6.12.*Not affected
  • 6.15.8 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.