CVE-2025-38103: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38103 Overview

CVE-2025-38103 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's USB Human Interface Device (HID) subsystem. The flaw resides in the usbhid_parse() function within the usbhid driver, where the struct hid_descriptor did not accurately reflect the mandatory and optional components defined by the USB HID 1.11 specification. A crafted or malformed HID descriptor can trigger an out-of-bounds memory read during parsing. The vulnerability affects the Linux kernel and Debian Linux 11.0 distributions.

Critical Impact
A local attacker with the ability to attach a malicious USB device can trigger kernel memory corruption, potentially causing denial of service or disclosing sensitive kernel memory contents.

Affected Products

Linux Kernel (multiple versions, including 4.14 release candidates and later stable branches)
Debian Linux 11.0
Systems using the usbhid driver to parse USB HID class descriptors

Discovery Timeline

2025-07-03 - CVE-2025-38103 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38103

Vulnerability Analysis

The vulnerability is an out-of-bounds read in usbhid_parse(), the function that processes USB HID class descriptors during device enumeration. The pre-patch struct hid_descriptor layout did not distinguish between the mandatory report descriptor and optional class descriptors defined by USB HID 1.11. Iteration over the descriptor array using a for loop with attacker-influenced counts allowed reads beyond the allocated structure. This is classified as [CWE-125] Out-of-Bounds Read.

Root Cause

The root cause is a structural mismatch between the kernel's hid_descriptor definition and the actual USB HID 1.11 layout. The member element desc[0] was used as a generic descriptor slot without enforcing bounds derived from bLength and bNumDescriptors. The parsing loop trusted these device-supplied fields without validation, permitting reads past the descriptor buffer when values were malformed or crafted to exceed the true descriptor size.

Attack Vector

Exploitation requires local access with the ability to connect a USB device or emulate one via a compromised peripheral. When the kernel enumerates the malicious device, usbhid_parse() processes the crafted HID descriptor and reads memory outside the intended bounds. The upstream fix renames desc[0] to rpt_desc, replaces the for loop with direct access to the mandatory report descriptor member, validates bLength and bNumDescriptors, and emits a warning when unsupported optional descriptors are encountered.

Detection Methods for CVE-2025-38103

Indicators of Compromise

Kernel log entries referencing usbhid_parse faults, KASAN out-of-bounds reports, or unexpected USB enumeration failures
Warning messages from the patched kernel indicating unsupported optional HID class descriptors
Unexpected system crashes or oops traces correlated with USB device insertion events

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test and staging environments to surface out-of-bounds reads in the usbhid code path
Monitor dmesg and journald for usbhid-related warnings and stack traces during USB device enumeration
Deploy USB device allowlisting and audit USB attach events using udev rules or auditd to correlate suspicious peripheral connections

Monitoring Recommendations

Collect and centralize kernel logs from Linux endpoints for anomaly detection around USB subsystem events
Track kernel version inventory across the fleet to confirm patched builds are deployed
Alert on repeated USB enumeration failures or kernel warnings tied to HID descriptor parsing

How to Mitigate CVE-2025-38103

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits to all affected systems
Debian 11 administrators should install the updates announced in the Debian LTS Security Announcement
Restrict physical access to systems and disable USB ports where they are not operationally required

Patch Information

The fix is distributed across multiple stable branches. Relevant commits include 1df80d74, 41827a2d, 485e1b74, 4fa7831c, 74388368, 7a6d6b68, a8f84253, and fe7f7ac8. Debian users should consult Debian LTS Announcement 8 for package updates.

Workarounds

Blocklist the usbhid kernel module on systems that do not require USB HID peripherals using /etc/modprobe.d/ configuration
Enforce USB device authorization by setting authorized_default to 0 on USB host controllers and explicitly authorizing trusted devices
Physically secure endpoints and enable BIOS-level USB port controls where feasible

bash

# Configuration example: disable automatic USB device authorization
echo 0 | sudo tee /sys/bus/usb/devices/usb1/authorized_default

# Blocklist usbhid where not needed
echo "blacklist usbhid" | sudo tee /etc/modprobe.d/blacklist-usbhid.conf
sudo update-initramfs -u