LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID

In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, meaning that instead of having 8 guaranteed bytes for implement to be working, we only have 7.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux HID buffer can be one byte too small when reports omit an ID. The resulting memory-safety condition could affect confidentiality, integrity, and availability. Exploitation requires adjacent access according to the supplied CVSS assessment, limiting internet-scale exposure but leaving systems that accept untrusted HID interactions at risk.

Executive priority

Treat as a high-priority patching issue for endpoints, kiosks, appliances, and shared systems exposed to untrusted HID interactions. Internet-only servers may have lower practical exposure, but the supplied evidence does not establish that they are universally unaffected. Use distribution-specific guidance before setting deadlines or exceptions.

Technical view

The HID core allocates a report buffer without accounting for the reserved leading zero byte expected by low-level transports when no report ID is used. This leaves seven guaranteed data bytes where eight are required. The supplied record scores the issue CVSS 3.1 8.8 with adjacent attack access, low complexity, no privileges, and no user interaction.

Likely exposure

Exposure is limited to Linux kernels containing the vulnerable HID core behavior and processing relevant HID reports. The supplied affected-version metadata includes several kernel versions but is insufficiently clear to derive reliable version intervals. Systems permitting untrusted or adjacent HID connectivity warrant priority review.

Exploitation context

The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or public weaponization. The adjacent CVSS vector indicates an attacker must reach a relevant nearby or locally connected attack surface; the precise transport and practical exploitability are not established by the supplied evidence.

Researcher notes

The reserved report-ID byte creates a one-byte allocation shortfall in the no-report-ID path. Multiple stable-tree commits are referenced, suggesting fixes across maintained branches. The version data contains duplicates and ambiguous boundaries, so commit ancestry or distribution package status is more reliable than interpreting the listed versions alone. No CWE or confirmed exploitation evidence is supplied.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable stable fix.
  • Consult Linux distribution advisories to identify corrected package versions.
  • Restrict untrusted HID connectivity while updates are pending.
  • Prioritize systems where adjacent parties can introduce or control HID interactions.

Validation and detection

  • Inventory deployed kernel and distribution package versions.
  • Compare each version against its distribution's CVE advisory and corrected package.
  • Confirm custom kernels contain the applicable stable commit in their ancestry.
  • Retest relevant HID functionality after updating the kernel.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38495 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2025-38495Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4fa5a7f76cc7b6ac87f57741edd2b124851d119f, 4fa5a7f76cc7b6ac87f57741edd2b124851d119f, 4fa5a7f76cc7b6ac87f57741edd2b124851d119f, 4fa5a7f76cc7b6ac87f57741edd2b124851d119f, 4fa5a7f76cc7b6ac87f57741edd2b124851d119f, 4fa5a7f76cc7b6ac87f57741edd2b124851d119f, 4fa5a7f76cc7b6ac87f57741edd2b124851d119f, 4fa5a7f76cc7b6ac87f57741edd2b124851d119funaffected
LinuxLinux3.15, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.147, 6.6.100, 6.12.40, 6.15.8, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.