LiveActive security incident?Get immediate response
CVE Record

CVE-2024-57986: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated with Resolution Multipliers. One of the errors was fixed by commit ea427a222d8b ("HID: core: Fix deadloop in hid_apply_multiplier."), but the other has not been fixed. This error arises because hid_apply_multipler() assumes that every Resolution Multiplier control is contained in a Logical Collection, i.e., there's no way the routine can ever set multiplier_collection to NULL. This is in spite of the fact that the function starts with a big comment saying: * "The Resolution Multiplier control must be contained in the same * Logical Collection as the control(s) to which it is to be applied. ... * If no Logical Collection is * defined, the Resolution Multiplier is associated with all * controls in the report." * HID Usage Table, v1.12, Section 4.3.1, p30 * * Thus, search from the current collection upwards until we find a * logical collection... The comment and the code overlook the possibility that none of the collections found may be a Logical Collection. The fix is to set the multiplier_collection pointer to NULL if the collection found isn't a Logical Collection.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-57986 is a Linux kernel HID input-handling flaw. The kernel assumed a HID Resolution Multiplier control always belonged to a Logical Collection, even though the HID rules allow otherwise. The public sources do not provide a CVSS score or confirm active exploitation.

Executive priority

Treat this as a patch-management item with uncertain severity, not as a confirmed emergency. Prioritize environments where untrusted HID devices or device passthrough are realistic, and rely on vendor kernel updates rather than custom workarounds.

Technical view

The bug is in hid_apply_multiplier() in the Linux HID core. It failed to handle the case where no Logical Collection exists for a Resolution Multiplier, leaving multiplier_collection assumptions inconsistent with the documented HID behavior. Stable kernel commits set the pointer to NULL when the found collection is not logical.

Likely exposure

Exposure is most relevant to Linux systems that process HID input, including systems accepting physical or virtual HID devices. The source bundle lists Linux kernel versions and stable fixes, but does not describe remote network exposure or specific device classes beyond HID.

Exploitation context

No KEV listing is present, and the provided sources do not claim active exploitation. The original issue was connected to syzbot fuzzing from 2019. Practical risk depends on whether an attacker can cause the target kernel to parse a crafted or unusual HID report.

Researcher notes

The public record lacks CVSS, CWE, and exploit details. Analysis should stay close to the HID parser logic and stable backports. Avoid assuming remote exploitability; the evidence only supports a HID core parsing defect fixed in Linux stable trees.

Mitigation direction

  • Update to a Linux kernel containing the referenced stable HID fix.
  • Apply distribution kernel updates, including relevant Debian LTS advisories where applicable.
  • Check vendor guidance for appliances or embedded products that ship Linux kernels.
  • Prioritize systems that accept untrusted physical, virtual, or passthrough HID devices.

Validation and detection

  • Inventory Linux kernel versions across servers, workstations, appliances, and embedded assets.
  • Compare running kernels against vendor advisories and the referenced stable commits.
  • Confirm distribution packages include the HID core Resolution Multiplier fix.
  • Review exposure to untrusted USB, Bluetooth, virtualization, or device passthrough inputs.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-57986 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
12Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5a4abb36f312cf83206b1b7d1308ba47cba0b3cc, 5a4abb36f312cf83206b1b7d1308ba47cba0b3cc, 5a4abb36f312cf83206b1b7d1308ba47cba0b3cc, 5a4abb36f312cf83206b1b7d1308ba47cba0b3cc, 5a4abb36f312cf83206b1b7d1308ba47cba0b3cc, 5a4abb36f312cf83206b1b7d1308ba47cba0b3cc, 5a4abb36f312cf83206b1b7d1308ba47cba0b3cc, 5a4abb36f312cf83206b1b7d1308ba47cba0b3ccunaffected
LinuxLinux5.0, 0, 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.76, 6.12.13, 6.13.2, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.