HID: core: ensure the allocated report buffer can contain the reserved report ID
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
|||||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | — |
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4327-1 | linux security update |
Debian DLA |
DLA-4328-1 | linux-6.1 security update |
Debian DSA |
DSA-5973-1 | linux security update |
Debian DSA |
DSA-5975-1 | linux security update |
EUVD |
EUVD-2025-22868 | In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, meaning that instead of having 8 guaranteed bytes for implement to be working, we only have 7. |
Ubuntu USN |
USN-7879-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7879-2 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7880-1 | Linux kernel (OEM) vulnerabilities |
Ubuntu USN |
USN-7879-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7909-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7879-4 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7909-2 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7909-3 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7910-1 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-7909-4 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7910-2 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7909-5 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7933-1 | Linux kernel (KVM) vulnerabilities |
Ubuntu USN |
USN-7934-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7938-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8028-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8028-2 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-8031-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-8028-3 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-8028-4 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-8028-5 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8031-2 | Linux kernel (GCP FIPS) vulnerabilities |
Ubuntu USN |
USN-8028-6 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-8031-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8052-1 | Linux kernel (Low Latency) vulnerabilities |
Ubuntu USN |
USN-8028-7 | Linux kernel (Low Latency NVIDIA) vulnerabilities |
Ubuntu USN |
USN-8028-8 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-8052-2 | Linux kernel (Xilinx) vulnerabilities |
Ubuntu USN |
USN-8074-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8074-2 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-8126-1 | Linux kernel (Azure) vulnerabilities |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.375% probability within 30 days)
Key SSVC decision points have not yet been added.
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Debian
Debian debian Linux |
|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:* |
|
| Vendors & Products |
Debian
Debian debian Linux |
|
| Metrics |
cvssV3_1
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Vendors & Products |
Linux
Linux linux Kernel |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, meaning that instead of having 8 guaranteed bytes for implement to be working, we only have 7. | |
| Title | HID: core: ensure the allocated report buffer can contain the reserved report ID | |
| References |
|
|