CVE-2025-38103

What it actually does

Out-of-bounds access during HID descriptor parsing in usbhid_parse() caused by unsafe indexing into a descriptor array instead of validated direct member access, allowing potential buffer faults when malformed or oversized descriptors are supplied.

Why it matters to the business

Attackers with local or USB device access could trigger kernel faults or crashes on affected Linux systems; low exploitability reduces immediate risk but still requires patching to maintain device compatibility and system stability in environments using HID peripherals.

How an attack unfolds

An attacker supplies a crafted USB HID device or descriptor that triggers the legacy for-loop indexing path; the kernel reads beyond intended bounds in the descriptor structure before the added length and count validation can intervene, potentially leading to a crash or limited information disclosure.

How to fix it

Update the Linux kernel to a version containing the fix that replaces the loop with direct rpt_desc access, adds bLength and bNumDescriptors validation, and emits warnings for unsupported optional descriptors; rebuild and deploy the updated kernel image across all affected hosts.

How to confirm the fix worked

Confirm the patch is present by inspecting the usbhid source for direct rpt_desc member access and the added validation checks; test with a device that supplies invalid bLength or extra optional descriptors to verify no fault occurs and warnings are logged when appropriate.

Typical attack path

1. Connect a malicious or malformed USB HID device to the target system
2. Trigger usbhid_parse() during device enumeration or driver binding
3. Supply descriptor data that exercises the unchecked desc[0] array indexing
4. Cause out-of-bounds memory access resulting in kernel fault or denial of service

How to detect it

Review kernel logs for usbhid warnings about unsupported optional descriptors or crashes during device enumeration; correlate USB device attachment events with subsequent faults in usbhid_parse paths.

What your security team should do

• Prioritize kernel updates on systems that handle untrusted USB HID devices such as kiosks or developer workstations
• Monitor EPSS trend and threat actor activity around related Linux kernel issues for any change in exploit maturity
• Restrict USB device attachment via policy or hardware controls until patches are applied