CVE-2025-39806
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-11-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.1.153-1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a slab out-of-bounds access in the Linux kernel's HID multitouch driver function mt_report_fixup(). A malicious HID device can exploit this by providing a report descriptor smaller than 607 bytes. The function attempts to access and patch byte offset 607 without verifying if the descriptor is large enough, leading to an out-of-bounds memory access. This can cause kernel memory corruption or crashes.
How can this vulnerability impact me? :
The vulnerability can allow a malicious HID device to cause out-of-bounds memory access in the kernel, potentially leading to system instability, crashes, or other unpredictable behavior. This could be exploited to disrupt system operations or possibly escalate privileges depending on the context.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for KASAN slab-out-of-bounds errors related to mt_report_fixup(). Specifically, look for messages similar to: 'BUG: KASAN: slab-out-of-bounds in mt_report_fixup'. You can use commands like 'dmesg | grep mt_report_fixup' or 'journalctl -k | grep mt_report_fixup' to find such kernel error messages indicating the vulnerability has been triggered.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed. The fix ensures that the descriptor size is checked before accessing byte offset 607 in mt_report_fixup(). Until the update is applied, avoid connecting untrusted or potentially malicious HID multitouch devices that could exploit this vulnerability.