CVE-2025-39806 Overview
CVE-2025-39806 is an out-of-bounds read vulnerability in the Linux kernel's HID multitouch driver. The flaw resides in the mt_report_fixup() function, which patches byte offset 607 of a HID report descriptor without first verifying that the descriptor is large enough. A malicious HID device supplying a report descriptor smaller than 608 bytes triggers a slab out-of-bounds read, detected by KASAN. The issue affects multiple Linux kernel versions and downstream distributions including Debian, and has also been referenced in a Siemens product security advisory.
Critical Impact
A malicious or crafted USB or Bluetooth HID device can trigger a kernel slab out-of-bounds read, leading to information disclosure or kernel crash and denial of service on affected systems.
Affected Products
- Linux Kernel (multiple stable and release-candidate branches, including 6.11-rc5 through 6.11-rc7 and 6.17-rc1 through 6.17-rc3)
- Debian Linux 11.0
- Siemens products bundling affected Linux kernel versions (see vendor advisory SSA-032379)
Discovery Timeline
- 2025-09-16 - CVE-2025-39806 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-39806
Vulnerability Analysis
The vulnerability is an out-of-bounds read [CWE-125] in the HID multitouch driver located in drivers/hid/hid-multitouch.c. The mt_report_fixup() function is invoked during HID device probing to patch quirks in report descriptors provided by attached input devices. The function attempts to read byte offset 607 of the descriptor, comparing it against 0x15 to decide whether to overwrite it with 0x25. This access assumes a minimum descriptor size that the code never validates.
When a device supplies a report descriptor shorter than 608 bytes, the read at offset 607 falls outside the allocated slab buffer. KASAN reports this as slab-out-of-bounds in mt_report_fixup+0x103/0x110 during the hid_open_report -> mt_probe -> hid_device_probe call chain. Consequences include kernel memory disclosure through side channels, kernel panic, or exploitable memory corruption depending on adjacent allocations.
Root Cause
The root cause is a missing bounds check before an indexed read into a variable-length buffer. The fix ensures the descriptor size is at least 608 bytes before dereferencing offset 607. Without this check, the driver trusts attacker-controlled length metadata sourced from the HID device.
Attack Vector
Exploitation requires local access to attach a malicious HID device, such as a crafted USB peripheral, a Bluetooth HID device, or a virtualized HID gadget exposed by a compromised low-privilege process. The attack executes automatically when the kernel probes the device and invokes mt_report_fixup(). No user interaction beyond device attachment is required.
The vulnerability is triggered by a HID report descriptor smaller than 608 bytes. The kernel reads one byte beyond the allocated slab object, producing the KASAN splat shown in the advisory and potentially leaking adjacent slab contents or destabilizing the kernel.
Detection Methods for CVE-2025-39806
Indicators of Compromise
- KASAN reports containing BUG: KASAN: slab-out-of-bounds in mt_report_fixup in dmesg or the kernel log.
- Unexpected kernel oops or panic entries referencing mt_probe, hid_open_report, or hid_device_probe in the call trace.
- Attachment of unknown or unauthorized USB or Bluetooth HID devices logged by udev immediately preceding a kernel fault.
Detection Strategies
- Audit running kernel versions against the fixed commits published on git.kernel.org to identify unpatched hosts.
- Correlate USB device attachment events with kernel log anomalies to identify malicious HID enumeration attempts.
- Enable KASAN on test and staging kernels to surface out-of-bounds accesses in the HID subsystem during fuzzing.
Monitoring Recommendations
- Forward journald and dmesg output to a centralized log platform and alert on KASAN or hid-multitouch fault signatures.
- Monitor USB and Bluetooth device attachment telemetry, especially on multi-user hosts, kiosks, and lab systems.
- Track kernel package versions across the fleet and flag systems still running versions listed in the affected CPE ranges.
How to Mitigate CVE-2025-39806
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits (for example, 0379eb8691b9, 3055309821dd, 4263e5851779, 7ab7311c43ae, c13e95587583, and d4e6e2680807).
- Install the Debian LTS update announced in Debian LTS Announcement DLA of October 2025 on Debian 11 systems.
- Review the Siemens Product Security Advisory SSA-032379 for guidance on affected industrial products.
Patch Information
The upstream fix adds a size check to mt_report_fixup() so that the descriptor is verified to be at least 608 bytes before offset 607 is read. Stable kernel branches received backports via the six commits listed above. Distribution kernels from Debian and vendor kernels shipped by Siemens have corresponding updates. Rebuild custom kernels from a patched source tree and reboot to activate the fix.
Workarounds
- Restrict physical access to systems and disable unused USB ports through BIOS or endpoint policy where feasible.
- Use USBGuard or equivalent USB device authorization frameworks to whitelist known HID devices and block unknown ones.
- Unload or blacklist the hid_multitouch kernel module on systems that do not require multitouch input, using modprobe.d configuration.
# Blacklist the hid-multitouch module until patched kernels are deployed
echo "blacklist hid_multitouch" | sudo tee /etc/modprobe.d/blacklist-hid-multitouch.conf
sudo depmod -a
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
