CVE-2025-21794

What it actually does

Stack-out-of-bounds read in hid-thrustmaster driver when usb_check_int_endpoints iterates ep_addr array lacking a terminating null element, causing kernel crash on access beyond array bounds.

Why it matters to the business

Kernel panic and system instability on Linux hosts using affected Thrustmaster HID devices, leading to unplanned downtime and potential loss of availability for systems running vulnerable kernels.

How an attack unfolds

An attacker supplies a USB device that loads the hid-thrustmaster driver; the missing null terminator in the ep_addr array allows usb_check_int_endpoints to read past the array end during endpoint validation, triggering the out-of-bounds access and kernel fault.

How to fix it

Upgrade Linux kernel to version containing commit 436f48c864186e9413d1b7c6e91767cc9e1a65b8 or later stable releases such as 6.6.79; rebuild and reboot affected systems.

How to confirm the fix worked

Verify kernel source contains the added null terminator in ep_addr and confirm running kernel version meets or exceeds the listed fixed releases; test with syzkaller or equivalent USB endpoint fuzzing.

Typical attack path

1. Connect malicious or malformed USB HID device to trigger hid-thrustmaster probe
2. Driver populates ep_addr array without final null terminator
3. usb_check_int_endpoints executes unbounded for loop over array
4. Kernel reads invalid stack memory causing panic

How to detect it

Review kernel logs for oops or panic messages referencing hid-thrustmaster or usb_check_int_endpoints; correlate USB device enumeration events with subsequent crashes on systems using older kernels.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-tenant Linux systems
• Monitor for Thrustmaster device attachments in high-risk environments
• Apply patches within standard maintenance windows given low EPSS and absence from KEV