CVE-2025-38556: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38556 Overview

CVE-2025-38556 is a Linux kernel vulnerability in the Human Interface Device (HID) core subsystem. The s32ton() conversion routine triggers a shift-out-of-bounds exception when converting a 32-bit quantity to a 0-bit quantity. The syzbot fuzzer discovered the flaw while testing malformed HID report fields containing a size value of zero. Buggy or malicious USB HID devices can supply such report descriptors and crash the kernel.

Critical Impact
A local attacker with the ability to attach or emulate a malicious HID device can trigger a kernel-side shift-out-of-bounds condition, resulting in denial of service and potential confidentiality impact through kernel state exposure.

Affected Products

Linux Kernel (upstream stable branches prior to the fix)
Distributions shipping vulnerable kernel versions with the HID core subsystem enabled
Systems accepting USB, Bluetooth, or I2C HID input devices

Discovery Timeline

2025-08-19 - CVE-2025-38556 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38556

Vulnerability Analysis

The flaw resides in the s32ton() helper inside the Linux kernel HID core. The function converts a signed 32-bit integer to a value expressed in a caller-specified number of bits. When the caller passes a bit count of zero, the internal shift operation exceeds the width of its operand type, producing undefined behavior flagged by the Undefined Behavior Sanitizer (UBSAN) as a shift-out-of-bounds fault. The Linux HID parser invokes s32ton() while decoding fields from device-supplied report descriptors, so a device advertising a report field with size = 0 reaches the faulty code path during parsing.

The upstream fix hardens s32ton() to return a sensible value when called with zero bits, matching the behavior already present in the companion snto32() routine. The maintainers chose to accept the malformed field rather than reject the device outright, preserving compatibility with existing buggy hardware.

Root Cause

The root cause is missing input validation on the bit-width parameter of s32ton(), classified as an out-of-bounds read weakness [CWE-125]. The function assumed callers would always pass a non-zero width, but the HID descriptor parser propagates any size value the device reports without sanitization.

Attack Vector

Exploitation requires local access, specifically the ability to attach a physical USB or Bluetooth HID device or emulate one through a virtual HID transport such as uhid or hidraw. An unprivileged local user with permission to open /dev/uhid can register a crafted report descriptor and trigger the fault during report parsing. The attack does not require user interaction beyond the device attachment itself.

The vulnerability produces a kernel crash and, depending on kernel configuration, may leak adjacent stack or register contents through the undefined shift result before the fault is caught. See the upstream commits linked in the Kernel Git Commit Update 4 and Kernel Git Commit Update 5 for the full patch context.

Detection Methods for CVE-2025-38556

Indicators of Compromise

Kernel log entries containing UBSAN: shift-out-of-bounds referencing hid-core.c or the s32ton symbol.
Repeated kernel oops or panic events immediately following USB or Bluetooth HID device attachment.
Unexpected use of the /dev/uhid character device by non-privileged processes.

Detection Strategies

Monitor dmesg and journalctl -k output for HID parser warnings and UBSAN reports referencing the HID subsystem.
Audit userspace processes opening /dev/uhid or /dev/hidraw*, correlating device attach events with process ancestry.
Enable kernel lockdown or auditd rules to log USB device insertions and match them against baselined hardware inventories.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on UBSAN or oops events referencing the HID subsystem.
Track USB device connect and disconnect events across production endpoints to identify anomalous device emulation activity.
Baseline expected HID device vendor and product IDs, flagging previously unseen descriptors on servers and workstations.

How to Mitigate CVE-2025-38556

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisories and rebuild affected kernel images.
Update to distribution-supplied kernel packages containing the s32ton() hardening fix as soon as vendors publish them.
Restrict access to /dev/uhid and /dev/hidraw* on multi-user systems by tightening udev rules and group ownership.

Patch Information

The fix is committed across multiple stable branches. Reference commits include 865ad8469fa2, 8b4a94b1510f, a6b87bfc2ab5, and d3b504146c11. Distribution maintainers will backport these to supported kernel series.

Workarounds

Disable the uhid kernel module where userspace HID emulation is not required by blacklisting it in /etc/modprobe.d/.
Enforce USB device allowlisting through usbguard to reject unknown HID devices at attach time.
Restrict physical access to systems that cannot be patched immediately, preventing attachment of untrusted HID hardware.

bash

# Blacklist the uhid module to prevent userspace HID emulation
echo 'blacklist uhid' | sudo tee /etc/modprobe.d/blacklist-uhid.conf
sudo rmmod uhid 2>/dev/null || true

# Restrict /dev/hidraw* access to a dedicated group
sudo groupadd -r hidusers
sudo tee /etc/udev/rules.d/90-hidraw.rules <<'EOF'
KERNEL=="hidraw*", GROUP="hidusers", MODE="0640"
EOF
sudo udevadm control --reload-rules