Cloudanix VulnDB

CVE-2025-37942

None

CVSS

—

EPSS

—

Published

May 20, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Connecting certain input devices to a computer could cause it to crash because the software did not properly check data from the device first.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to refetch a potentially corrupted HID pool report before accessing its SIMULTANEOUS_MAX field allows use of uninitialized or invalid memory, resulting in kernel oops or memory corruption.

Why it matters to the business

Systems may experience unexpected crashes or instability when certain USB input devices are connected, leading to downtime and potential loss of availability on affected Linux kernels.

How an attack unfolds

An attacker connects a malicious or malformed HID device that returns a corrupted pool report; the driver then dereferences fields from stale memory, triggering a kernel fault that can be used for denial of service.

How to fix it

Update to a fixed kernel version such as 6.12.24 or later for mainline Linux, or apply the corresponding Ubuntu linux-aws package updates (4.4.0-1138.144 or newer) that contain the pool-report refetch fix.

How to confirm the fix worked

Verify the running kernel version is at or above the listed fixed releases; confirm the pidff driver contains the for-loop refetch logic and test with the previously affected VRS DirectForce PRO device if available.

Typical attack path

  1. Attacker prepares or modifies a HID device to supply a malformed pool report
  2. Device is connected to a vulnerable Linux system
  3. pidff driver reads the report without refetching
  4. Access to SIMULTANEOUS_MAX or related fields causes invalid memory reference
  5. Kernel oops occurs, crashing the system or allowing further memory corruption

How to detect it

Review kernel logs for oops or panic entries referencing pidff or HID pool report handling around the time of device connection; look for repeated attempts to initialize force-feedback devices that precede crashes.

What your security team should do

  • Prioritize kernel upgrades on all systems that use HID force-feedback devices
  • Apply the specific fixed package versions provided for each distribution
  • Monitor vendor advisories for additional backported fixes in older kernels
  • Test HID peripherals in a lab environment before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX As noted by Anssi some 20 years ago, pool report is sometimes messed up. This worked fine on many devices but casued oops on VRS DirectForce PRO. Here, we're making sure pool report is refetched before trying to access any of it's fields. While loop was replaced with a for loop + exit conditions were moved aroud to decrease the possibility of creating an infinite loop scenario.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 6.12.25-1
Linux Kernel 0 6.12.24

Related vulnerabilities