CVE-2024-39509

What it actually does

Local process can trigger a kernel WARN_ON in hid_output_report by submitting an output report containing a value larger than the target field size; the value is masked but the warning still fires.

Why it matters to the business

Low-severity local denial-of-service or log-flood risk on systems exposing HID devices to untrusted local users; no remote impact or data compromise.

How an attack unfolds

An attacker with local access opens a hidraw or hiddev node, crafts an output report descriptor that declares a small field, then issues an ioctl that supplies a larger value, causing the implement() function to hit the WARN_ON before the value is trimmed.

How to fix it

Upgrade the Linux kernel to a version containing commit 955b3764671f3f157215194972d9c01a3a4bd316 or later stable backports; no configuration changes required.

How to confirm the fix worked

Confirm the running kernel git commit or version string contains 955b3764671f3f157215194972d9c01a3a4bd316; attempt to reproduce the original syzkaller reproducer and verify absence of the warning.

Typical attack path

1. Obtain local shell or userland process on a Linux system with HID support
2. Locate or create a hiddev/hidraw device node
3. Build a malicious HID output report with oversized field value
4. Call hiddev_ioctl or equivalent to submit the report
5. Trigger the WARN_ON in implement()

How to detect it

Search kernel logs for the specific WARNING line referencing drivers/hid/hid-core.c:1451 and hid_output_report; correlate with process names performing HID ioctls.

• WARNING: CPU:.*PID:.*at drivers/hid/hid-core.c:1451 implement
• hid_output_report+0x548/0x760

What your security team should do

• Prioritize kernel updates on multi-user or developer workstations that expose HID interfaces
• Monitor vendor kernel update channels for the referenced commit
• Review local HID device permissions to limit exposure until patched