CVE-2025-38494 (GCVE-0-2025-38494)

Vulnerability from cvelistv5 – Published: 2025-07-28 11:22 – Updated: 2026-08-05 12:02
VLAI
Title
HID: core: do not bypass hid_hw_raw_request
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f , < dd8e8314f2ce225dade5248dcfb9e2ac0edda624 (git)
Affected: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f , < 40e25aa7e4e0f2440c73a683ee448e41c7c344ed (git)
Affected: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f , < f10923b8d32a473b229477b63f23bbd72b1e9910 (git)
Affected: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f , < a62a895edb2bfebffa865b5129a66e3b4287f34f (git)
Affected: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f , < 0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81 (git)
Affected: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f , < d18f63e848840100dbc351a82e7042eac5a28cf5 (git)
Affected: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f , < 19d1314d46c0d8a5c08ab53ddeb62280c77698c0 (git)
Affected: 4fa5a7f76cc7b6ac87f57741edd2b124851d119f , < c2ca42f190b6714d6c481dfd3d9b62ea091c946b (git)
Create a notification for this product.
Linux Linux Affected: 3.15
Unaffected: 0 , < 3.15 (semver)
Unaffected: 5.4.297 , ≤ 5.4.* (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.147 , ≤ 6.1.* (semver)
Unaffected: 6.6.100 , ≤ 6.6.* (semver)
Unaffected: 6.12.40 , ≤ 6.12.* (semver)
Unaffected: 6.15.8 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:01.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd8e8314f2ce225dade5248dcfb9e2ac0edda624",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "40e25aa7e4e0f2440c73a683ee448e41c7c344ed",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "f10923b8d32a473b229477b63f23bbd72b1e9910",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "a62a895edb2bfebffa865b5129a66e3b4287f34f",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "d18f63e848840100dbc351a82e7042eac5a28cf5",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "19d1314d46c0d8a5c08ab53ddeb62280c77698c0",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "c2ca42f190b6714d6c481dfd3d9b62ea091c946b",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: do not bypass hid_hw_raw_request\n\nhid_hw_raw_request() is actually useful to ensure the provided buffer\nand length are valid. Directly calling in the low level transport driver\nfunction bypassed those checks and allowed invalid paramto be used."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker supplies the malicious HID report descriptor through a local interface \u2014 `/dev/uhid` (UHID_CREATE2) \u2014 and triggers `hid_hw_request()` locally via device connect, an EV_LED write, or a force-feedback ioctl on `/dev/input/eventX`; no network or adjacent-network path is involved.\nAC:L - The attacker fully controls both the report descriptor that produces the degenerate `hid_report_len() == 0` value and the moment the request is issued, so the unvalidated length reaches the transport driver deterministically with no race or environmental precondition.\nPR:L - Only access to a HID char device is needed \u2014 `/dev/uhid` and `/dev/input/event*`/`hidraw` nodes are granted to the logged-in seat user via udev `uaccess` tagging on desktop and Android-class systems, and are routinely exposed inside privileged containers, so no real root in the initial namespace is required.\nUI:N - The attacker\u0027s own process creates the uhid device and issues the triggering request; `hidinput_change_resolution_multipliers()` fires the GET_REPORT automatically at device connect with no action from any other user.\nS:U - The corrupted memory and the bypassed validation are both inside the kernel\u0027s HID subsystem, managed by the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked `len == 0` causes a `size_t` underflow (`count--`) in transport handlers such as `i2c_hid_get_raw_report()` and `usbhid_get_raw_report()`, so an over-long response is copied out and then passed to `hid_input_report()` with an inflated size, exposing adjacent heap contents through input/hidraw data readable from userspace.\nI:H - The same underflow makes `i2c_hid_get_report()` memcpy up to `ihid-\u003ebufsize` bytes of device-controlled data into a 7-byte `hid_alloc_report_buf()` allocation \u2014 a controlled heap out-of-bounds write usable as a control-flow-hijack primitive; the patch additionally restores the bypassed HID-BPF request-filtering hook.\nA:H - Passing an invalid length into the low-level transport produces heap out-of-bounds reads and writes that reliably trigger KASAN reports, slab corruption, and kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:23.039Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd8e8314f2ce225dade5248dcfb9e2ac0edda624"
        },
        {
          "url": "https://git.kernel.org/stable/c/40e25aa7e4e0f2440c73a683ee448e41c7c344ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/f10923b8d32a473b229477b63f23bbd72b1e9910"
        },
        {
          "url": "https://git.kernel.org/stable/c/a62a895edb2bfebffa865b5129a66e3b4287f34f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81"
        },
        {
          "url": "https://git.kernel.org/stable/c/d18f63e848840100dbc351a82e7042eac5a28cf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/19d1314d46c0d8a5c08ab53ddeb62280c77698c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2ca42f190b6714d6c481dfd3d9b62ea091c946b"
        }
      ],
      "title": "HID: core: do not bypass hid_hw_raw_request",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38494",
    "datePublished": "2025-07-28T11:22:03.180Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:23.039Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38494",
      "date": "2026-08-05",
      "epss": "0.002",
      "percentile": "0.10075"
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-04T01:11:10.000Z",
      "cve": "CVE-2025-38494",
      "id": "msrc_CVE-2025-38494",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "HID: core: do not bypass hid_hw_raw_request",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38494.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38494\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-28T12:15:31.607\",\"lastModified\":\"2026-07-30T06:23:21.557\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nHID: core: do not bypass hid_hw_raw_request\\n\\nhid_hw_raw_request() is actually useful to ensure the provided buffer\\nand length are valid. Directly calling in the low level transport driver\\nfunction bypassed those checks and allowed invalid paramto be used.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: n\u00facleo: no omitir hid_hw_raw_request. hid_hw_raw_request() es \u00fatil para garantizar la validez del b\u00fafer y la longitud proporcionados. Llamar directamente a la funci\u00f3n del controlador de transporte de bajo nivel omit\u00eda estas comprobaciones y permit\u00eda el uso de par\u00e1metros no v\u00e1lidos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hid/hid-core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4fa5a7f76cc7b6ac87f57741edd2b124851d119f\",\"lessThan\":\"dd8e8314f2ce225dade5248dcfb9e2ac0edda624\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4fa5a7f76cc7b6ac87f57741edd2b124851d119f\",\"lessThan\":\"40e25aa7e4e0f2440c73a683ee448e41c7c344ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4fa5a7f76cc7b6ac87f57741edd2b124851d119f\",\"lessThan\":\"f10923b8d32a473b229477b63f23bbd72b1e9910\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4fa5a7f76cc7b6ac87f57741edd2b124851d119f\",\"lessThan\":\"a62a895edb2bfebffa865b5129a66e3b4287f34f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4fa5a7f76cc7b6ac87f57741edd2b124851d119f\",\"lessThan\":\"0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4fa5a7f76cc7b6ac87f57741edd2b124851d119f\",\"lessThan\":\"d18f63e848840100dbc351a82e7042eac5a28cf5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4fa5a7f76cc7b6ac87f57741edd2b124851d119f\",\"lessThan\":\"19d1314d46c0d8a5c08ab53ddeb62280c77698c0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4fa5a7f76cc7b6ac87f57741edd2b124851d119f\",\"lessThan\":\"c2ca42f190b6714d6c481dfd3d9b62ea091c946b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hid/hid-core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.297\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.241\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.190\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.147\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.100\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.40\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.8\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.15\",\"versionEndExcluding\":\"5.4.297\",\"matchCriteriaId\":\"6D7384E1-E9E8-41E0-AF24-1571E21AC42F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.241\",\"matchCriteriaId\":\"D0D21C35-EB8A-488A-BBF9-403E4817E5DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.190\",\"matchCriteriaId\":\"AD9E597F-3DDE-4D7E-976C-463D0611F13F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.147\",\"matchCriteriaId\":\"A4FD62FC-0DAE-4ACE-8C9C-66156518C3E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.100\",\"matchCriteriaId\":\"094B81E0-B756-4727-85CA-F3F8D1C9D116\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.40\",\"matchCriteriaId\":\"0099D5A4-B157-4D36-8858-982C7D579030\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.8\",\"matchCriteriaId\":\"C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3827F0D4-5FEE-4181-B267-5A45E7CA11FC\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/19d1314d46c0d8a5c08ab53ddeb62280c77698c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40e25aa7e4e0f2440c73a683ee448e41c7c344ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a62a895edb2bfebffa865b5129a66e3b4287f34f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c2ca42f190b6714d6c481dfd3d9b62ea091c946b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d18f63e848840100dbc351a82e7042eac5a28cf5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd8e8314f2ce225dade5248dcfb9e2ac0edda624\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f10923b8d32a473b229477b63f23bbd72b1e9910\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:03:58+00:00",
      "cve": "CVE-2025-38494",
      "id": "CVE-2025-38494",
      "initial_release_date": "2025-07-28T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: HID: core: do not bypass hid_hw_raw_request",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38494.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T00:45:32Z",
      "cve": "CVE-2025-38494",
      "id": "CVE-2025-38494",
      "initial_release_date": "2025-07-28T23:22:25Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "441",
      "product_status:known_not_affected": "66",
      "product_status:recommended": "944",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38494",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38494.json",
      "version": "56"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.