CVE-2025-39808

What it actually does

Null pointer dereference in ntrig_report_version() when hdev->dev.parent->parent is null after descriptor sent via /dev/uhid, causing hid_to_usb_dev() to return invalid address and page fault on usb_rcvctrlpipe().

Why it matters to the business

Local users can trigger kernel crashes leading to denial of service on systems using affected hid-ntrig hardware; widespread kernel deployments increase exposure risk.

How an attack unfolds

An attacker with local access sends a crafted HID descriptor through /dev/uhid to nullify parent pointers, then triggers ntrig_report_version() via hid_probe() to dereference an invalid address and crash the kernel.

How to fix it

Apply kernel patch containing commit 22ddb5eca4af5e69dffe2b54551d2487424448f1 or upgrade to fixed versions such as uw-imap 7:2002c on Debian 11/12.

How to confirm the fix worked

Confirm presence of null check before hid_to_usb_dev() call in ntrig_report_version(); verify kernel version contains the referenced commit.

Typical attack path

1. Obtain local user access on target system
2. Open /dev/uhid and write descriptor that sets hdev->dev.parent->parent to null
3. Trigger hid_probe() path invoking ntrig_report_version()
4. Observe page fault at invalid address from hid_to_usb_dev()

How to detect it

Review kernel logs for page fault at address 0xffffffffffffff58 in usb_rcvctrlpipe or hid-ntrig paths; inspect uhid device writes preceding crashes.

What your security team should do

• Prioritize kernel upgrade on systems exposing /dev/uhid or using n-trig devices
• Monitor for local privilege contexts that could abuse the crash
• Restrict unprivileged access to /dev/uhid where feasible