GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38253 (GCVE-0-2025-38253)

Vulnerability from cvelistv5 – Published: 2025-07-09 10:42 – Updated: 2026-08-05 12:00
VLAI
Title
HID: wacom: fix crash in wacom_aes_battery_handler()
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix crash in wacom_aes_battery_handler() Commit fd2a9b29dc9c ("HID: wacom: Remove AES power_supply after extended inactivity") introduced wacom_aes_battery_handler() which is scheduled as a delayed work (aes_battery_work). In wacom_remove(), aes_battery_work is not canceled. Consequently, if the device is removed while aes_battery_work is still pending, then hard crashes or "Oops: general protection fault..." are experienced when wacom_aes_battery_handler() is finally called. E.g., this happens with built-in USB devices after resume from hibernate when aes_battery_work was still pending at the time of hibernation. So, take care to cancel aes_battery_work in wacom_remove().
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fd2a9b29dc9c4c35def91d5d1c5b470843539de6 , < a4f182ffa30c52ad1c8e12edfb8049ee748c0f1b (git)
Affected: fd2a9b29dc9c4c35def91d5d1c5b470843539de6 , < 57a3d82200dbeccd002244b96acad570eeeb731f (git)
Affected: fd2a9b29dc9c4c35def91d5d1c5b470843539de6 , < f3054152c12e2eed1e72704aff47b0ea58229584 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.36 , ≤ 6.12.* (semver)
Unaffected: 6.15.5 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/wacom_sys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a4f182ffa30c52ad1c8e12edfb8049ee748c0f1b",
              "status": "affected",
              "version": "fd2a9b29dc9c4c35def91d5d1c5b470843539de6",
              "versionType": "git"
            },
            {
              "lessThan": "57a3d82200dbeccd002244b96acad570eeeb731f",
              "status": "affected",
              "version": "fd2a9b29dc9c4c35def91d5d1c5b470843539de6",
              "versionType": "git"
            },
            {
              "lessThan": "f3054152c12e2eed1e72704aff47b0ea58229584",
              "status": "affected",
              "version": "fd2a9b29dc9c4c35def91d5d1c5b470843539de6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/wacom_sys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.36",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.5",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix crash in wacom_aes_battery_handler()\n\nCommit fd2a9b29dc9c (\"HID: wacom: Remove AES power_supply after extended\ninactivity\") introduced wacom_aes_battery_handler() which is scheduled\nas a delayed work (aes_battery_work).\n\nIn wacom_remove(), aes_battery_work is not canceled. Consequently, if\nthe device is removed while aes_battery_work is still pending, then hard\ncrashes or \"Oops: general protection fault...\" are experienced when\nwacom_aes_battery_handler() is finally called. E.g., this happens with\nbuilt-in USB devices after resume from hibernate when aes_battery_work\nwas still pending at the time of hibernation.\n\nSo, take care to cancel aes_battery_work in wacom_remove()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The wacom driver binds any Bluetooth HID device presenting Wacom\u0027s vendor ID via `BT_DEVICE_WACOM(HID_ANY_ID)` and hid-core\u0027s forced `HID_GROUP_WACOM`, so an attacker within Bluetooth range supplying a crafted report descriptor and pen reports reaches the vulnerable path. This matches the adjacent-network scoring used for other Wacom HID report-processing flaws.\nAC:L - The attacker device controls every step \u2014 the report descriptor that sets WACOM_QUIRK_AESPEN, the pen report with sense=0 that arms the work, and the disconnect that frees `struct wacom` \u2014 and the 30-minute delay window guarantees the work is still pending at removal. No race must be won and no uncontrollable state is required.\nPR:N - Everything happens inside kernel HID transport and driver probe/report/remove handling; no user account, credential, or capability on the target is involved. The attacker only needs their device connected to the host.\nUI:N - Once the device is connected, arming the delayed work and then tearing down the link are entirely device-driven with no action by any user on the target. Consistent with prior Wacom HID CVEs scored UI:N.\nS:U - The use-after-free corrupts kernel heap memory and executes within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed devm-allocated `struct wacom` is a sprayable slab object whose contents are subsequently used as a workqueue pointer, work function pointer, and `hdev` pointer, giving an attacker who grooms the slab an arbitrary-read/kernel-memory-disclosure primitive.\nI:H - `process_one_work()` invokes `work-\u003efunc()` read from the freed object and `devres_release_group()` walks stale list data invoking release callbacks, yielding control-flow hijack and arbitrary-write potential; the leftover armed timer in the timer wheel adds list-corruption write primitives.\nA:H - The commit explicitly reports \"hard crashes or \u0027Oops: general protection fault\u0027\" when the pending work fires after device removal, and the attacker can trigger this repeatedly by reconnecting and disconnecting."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:46.365Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a4f182ffa30c52ad1c8e12edfb8049ee748c0f1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/57a3d82200dbeccd002244b96acad570eeeb731f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3054152c12e2eed1e72704aff47b0ea58229584"
        }
      ],
      "title": "HID: wacom: fix crash in wacom_aes_battery_handler()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38253",
    "datePublished": "2025-07-09T10:42:32.059Z",
    "dateReserved": "2025-04-16T04:51:23.997Z",
    "dateUpdated": "2026-08-05T12:00:46.365Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38253",
      "date": "2026-09-19",
      "epss": "0.00203",
      "percentile": "0.10623"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/wacom_sys.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a4f182ffa30c52ad1c8e12edfb8049ee748c0f1b",
                    "status": "affected",
                    "version": "fd2a9b29dc9c4c35def91d5d1c5b470843539de6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "57a3d82200dbeccd002244b96acad570eeeb731f",
                    "status": "affected",
                    "version": "fd2a9b29dc9c4c35def91d5d1c5b470843539de6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f3054152c12e2eed1e72704aff47b0ea58229584",
                    "status": "affected",
                    "version": "fd2a9b29dc9c4c35def91d5d1c5b470843539de6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/wacom_sys.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.36",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "43D7DB82-85C8-430B-8E53-E64803302D3A",
                    "versionEndExcluding": "6.12.36",
                    "versionStartIncluding": "6.8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0CC768E2-3BBC-4A6E-9C2F-ECB27A703C2D",
                    "versionEndExcluding": "6.15.5",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix crash in wacom_aes_battery_handler()\n\nCommit fd2a9b29dc9c (\"HID: wacom: Remove AES power_supply after extended\ninactivity\") introduced wacom_aes_battery_handler() which is scheduled\nas a delayed work (aes_battery_work).\n\nIn wacom_remove(), aes_battery_work is not canceled. Consequently, if\nthe device is removed while aes_battery_work is still pending, then hard\ncrashes or \"Oops: general protection fault...\" are experienced when\nwacom_aes_battery_handler() is finally called. E.g., this happens with\nbuilt-in USB devices after resume from hibernate when aes_battery_work\nwas still pending at the time of hibernation.\n\nSo, take care to cancel aes_battery_work in wacom_remove()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: wacom: correcci\u00f3n de fallo en wacom_aes_battery_handler(). El commit fd2a9b29dc9c (\"HID: wacom: Eliminar la fuente de alimentaci\u00f3n AES tras una inactividad prolongada\") introdujo wacom_aes_battery_handler(), que est\u00e1 programado como un trabajo retrasado (aes_battery_work). En wacom_remove(), aes_battery_work no se cancela. Por lo tanto, si se retira el dispositivo mientras aes_battery_work est\u00e1 pendiente, se producen fallos graves o el error \"Uy: fallo de protecci\u00f3n general...\" al ejecutar wacom_aes_battery_handler(). Por ejemplo, esto ocurre con dispositivos USB integrados tras la reanudaci\u00f3n de la hibernaci\u00f3n cuando aes_battery_work estaba pendiente en ese momento. Por lo tanto, tenga cuidado de cancelar aes_battery_work en wacom_remove()."
          }
        ],
        "id": "CVE-2025-38253",
        "lastModified": "2026-07-30T06:23:04.613",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-09T11:15:27.540",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/57a3d82200dbeccd002244b96acad570eeeb731f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a4f182ffa30c52ad1c8e12edfb8049ee748c0f1b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f3054152c12e2eed1e72704aff47b0ea58229584"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:13:20+00:00",
      "cve": "CVE-2025-38253",
      "id": "CVE-2025-38253",
      "initial_release_date": "2025-07-09T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: HID: wacom: fix crash in wacom_aes_battery_handler()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38253.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:49:26Z",
      "cve": "CVE-2025-38253",
      "id": "CVE-2025-38253",
      "initial_release_date": "2025-07-09T23:23:00Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "524",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38253",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38253.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.