CVE-2025-38494

What it actually does

The flaw permits direct invocation of low-level HID transport driver functions, bypassing hid_hw_raw_request validation of buffer and length parameters and allowing invalid inputs to reach the driver.

Why it matters to the business

Local attackers can achieve high-impact outcomes including privilege escalation and system compromise on Linux hosts; elevated urgency due to listing alongside other kernel privilege-escalation issues in espionage and financially motivated campaigns and 456 days of public exposure.

How an attack unfolds

An attacker with local access supplies crafted invalid parameters to HID raw request paths, evading the centralized checks that hid_hw_raw_request would have enforced, thereby triggering unsafe behavior in the transport driver; similar techniques appear in Advanced Spyware Campaign and 2024 Zero-Day Exploitation activity targeting kernel flaws.

How to fix it

Upgrade the Linux kernel to a version containing the fix that restores use of hid_hw_raw_request; apply the referenced commit 7040aa54f14676938970e10c5f74ea93cd56aa38 (and equivalent upstream patches) across all affected distributions.

How to confirm the fix worked

Confirm the running kernel contains the commit that re-routes calls through hid_hw_raw_request; verify no downstream code paths still invoke the low-level driver directly without the validation wrapper.

Typical attack path

1. Gain local user access on an affected Linux system
2. Locate or create an HID device context
3. Invoke low-level transport functions directly with invalid buffer or length values
4. Trigger kernel code paths that were intended to be guarded
5. Escalate privileges or execute arbitrary code

How to detect it

Review kernel audit logs and HID subsystem traces for direct calls to transport-layer request functions that bypass the standard validation entry point; look for anomalous parameter lengths or buffer addresses originating from user-space processes interacting with HID devices.

• direct call to usbhid_raw_request without hid_hw_raw_request wrapper
• invalid length or buffer pointer passed to hid transport driver

What your security team should do

• Prioritize kernel updates on all Linux endpoints within the next patching cycle given campaign associations
• Audit custom HID drivers or user-space tools that call raw request functions
• Monitor EPSS trend and threat-actor mentions for any increase in observed exploitation
• Apply compensating controls such as kernel lockdown features until patches are deployed