Security readout for executives and security teams
Plain-English summary
A Linux Wacom tablet-driver cleanup flaw can crash a system after a device is removed while scheduled battery-related work remains pending. The documented example involves built-in USB devices resuming from hibernation. This is primarily a stability and availability concern based on the supplied technical description.
Executive priority
Treat this as a high-priority reliability patch for exposed endpoints, particularly fleets using Wacom hardware and hibernation. It is not supported as an active-exploitation emergency by the supplied evidence. Broader urgency depends on driver use, vulnerable kernel deployment, and whether crashes materially disrupt critical operations.
Technical view
The Wacom HID driver schedules wacom_aes_battery_handler() as delayed work. wacom_remove() failed to cancel that work, allowing the handler to run after device removal and trigger a general-protection fault or hard crash. The stable fixes cancel aes_battery_work during removal. The supplied CVSS is 8.8, although the description does not substantiate confidentiality or integrity impact.
Likely exposure
Exposure is most likely on Linux systems using the Wacom AES HID driver where device removal, hibernation, or resume can overlap pending battery work. The supplied affected-version data includes 6.8, 6.12.36, 6.15.5, and 6.16, but its exact range structure is unclear; confirm against distribution advisories and backports.
Exploitation context
The supplied record does not identify public exploitation, and the CVE is not listed as KEV in the bundle. Triggering requires a device-lifecycle condition involving pending driver work and removal. Evidence supports a crash scenario, especially around hibernation and built-in USB devices, but does not establish remote compromise or data theft.
Researcher notes
The defect was introduced by commit fd2a9b29dc9c and corrected by canceling delayed AES battery work in wacom_remove(). The record’s CVSS vector claims high confidentiality, integrity, and availability impact, while its narrative documents crashes only. Exact affected-version boundaries are not reliably represented in the supplied flattened version list, so branch-specific commit ancestry or vendor backport status should govern validation.
Mitigation direction
- Install a distribution kernel containing the applicable upstream stable fix.
- Check vendor advisories for backports covering the deployed kernel build.
- Prioritize systems using Wacom AES devices or hibernation workflows.
- Where updates are delayed, reduce affected device-removal and hibernation scenarios if operationally practical.
Validation and detection
- Inventory kernel versions and systems loading the Wacom HID driver.
- Confirm the vendor kernel includes one of the cited stable fixes or an equivalent backport.
- Review kernel logs for general-protection faults involving wacom_aes_battery_handler().
- Test device removal and hibernation-resume behavior safely after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38253 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a4f182ffa30c52ad1c8e12edfb8049ee748c0f1bCVE reference, Linux
- https://git.kernel.org/stable/c/57a3d82200dbeccd002244b96acad570eeeb731fCVE reference, Linux
- https://git.kernel.org/stable/c/f3054152c12e2eed1e72704aff47b0ea58229584CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.