CVE-2025-39808

HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()

State: Published
Severity: Not scored
Published: Sep 16, 2025
Updated: May 12, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()

in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58)

add null check logic to ntrig_report_version() before calling hid_to_usb_dev()

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0277873c05158c5efc97c23d52e6aec6250bde0f to before 22ddb5eca4af5e69dffe2b54551d2487424448f1Affected 0277873c05158c5efc97c23d52e6aec6250bde0f to before 019c34ca11372de891c06644846eb41fca7c890cAffected 0277873c05158c5efc97c23d52e6aec6250bde0f to before 4338b0f6544c3ff042bfbaf40bc9afe531fb08c7Affected 0277873c05158c5efc97c23d52e6aec6250bde0f to before 6070123d5344d0950f10ef6a5fdc3f076abb7ad2Affected 0277873c05158c5efc97c23d52e6aec6250bde0f to before e422370e6ab28478872b914cee5d49a9bdfae0c6Affected 0277873c05158c5efc97c23d52e6aec6250bde0f to before 98520a9a3d69a530dd1ee280cbe0abc232a35bffAffected 0277873c05158c5efc97c23d52e6aec6250bde0f to before 183def8e4d786e50165e5d992df6a3083e45e16cAffected 0277873c05158c5efc97c23d52e6aec6250bde0f to before 185c926283da67a72df20a63a5046b3b4631b7d9Affected
LinuxLinux	2.6.37Affected before 2.6.37Not affected 5.4.298 through 5.4.Not affected 5.10.242 through 5.10.Not affected 5.15.191 through 5.15.Not affected 6.1.150 through 6.1.Not affected 6.6.104 through 6.6.Not affected 6.12.45 through 6.12.Not affected 6.16.5 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

0277873c05158c5efc97c23d52e6aec6250bde0f to before 22ddb5eca4af5e69dffe2b54551d2487424448f1Affected
0277873c05158c5efc97c23d52e6aec6250bde0f to before 019c34ca11372de891c06644846eb41fca7c890cAffected
0277873c05158c5efc97c23d52e6aec6250bde0f to before 4338b0f6544c3ff042bfbaf40bc9afe531fb08c7Affected
0277873c05158c5efc97c23d52e6aec6250bde0f to before 6070123d5344d0950f10ef6a5fdc3f076abb7ad2Affected
0277873c05158c5efc97c23d52e6aec6250bde0f to before e422370e6ab28478872b914cee5d49a9bdfae0c6Affected
0277873c05158c5efc97c23d52e6aec6250bde0f to before 98520a9a3d69a530dd1ee280cbe0abc232a35bffAffected
0277873c05158c5efc97c23d52e6aec6250bde0f to before 183def8e4d786e50165e5d992df6a3083e45e16cAffected
0277873c05158c5efc97c23d52e6aec6250bde0f to before 185c926283da67a72df20a63a5046b3b4631b7d9Affected

LinuxLinux

2.6.37Affected
before 2.6.37Not affected
5.4.298 through 5.4.*Not affected
5.10.242 through 5.10.*Not affected
5.15.191 through 5.15.*Not affected
6.1.150 through 6.1.*Not affected
6.6.104 through 6.6.*Not affected
6.12.45 through 6.12.*Not affected
6.16.5 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.