CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits
Vulnerability summary
CVE-2025-38556 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.4% of scored vulnerabilities.
Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 60 · Related 43Timeline
- 19-08-2025PublishedVulnerability first disclosed.
- 11-06-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu147 products
- linuxAll versions (No fix recorded) | < 5.15.0-173.183 | < 6.8.0-106.106
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1103.110 | < 6.8.0-1050.53
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ dde5845a529ff753364a6d1aea61180946270bfa, < 6cdf6c708717c5c6897d0800a1793e83757c7491 | ≥ dde5845a529ff753364a6d1aea61180946270bfa, < eeeaba737919bdce9885e2a00ac2912f61a3684d | ≥ dde5845a529ff753364a6d1aea61180946270bfa, < 3c86548a20d7bc2861aa4de044991a327bebad1a | ≥ dde5845a529ff753364a6d1aea61180946270bfa, < 810189546cb6c8f36443ed091d91f1f5d2fc2ec7 | ≥ dde5845a529ff753364a6d1aea61180946270bfa, < d3b504146c111548ab60b6ef7aad00bfb1db05a2 | ≥ dde5845a529ff753364a6d1aea61180946270bfa, < 8b4a94b1510f6a46ec48494b52ee8f67eb4fc836 | ≥ dde5845a529ff753364a6d1aea61180946270bfa, < 865ad8469fa24de1559f247d9426ab01e5ce3a56 | ≥ dde5845a529ff753364a6d1aea61180946270bfa, < a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd | 2.6.20
- linux_kernel≥ 2.6.20, < 6.12.46 | ≥ 6.13, < 6.15.10 | ≥ 6.16, < 6.16.1
Debian1 product
- linux< 6.1.159-1 | < 6.12.48-1 | < 6.16.3-1
3 vendors · 150 products
