CVE-2025-39808
Description
In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev()
How to fix
- linux linux_kernel5.4.298, 5.10.242, 5.15.191, 6.1.150, 6.6.104, 6.12.45, 6.16.5 or later
- git.kernel.org/stable/c/019c34ca11372de891c06644846eb41fca7c890c
- git.kernel.org/stable/c/183def8e4d786e50165e5d992df6a3083e45e16c
- git.kernel.org/stable/c/185c926283da67a72df20a63a5046b3b4631b7d9
- git.kernel.org/stable/c/22ddb5eca4af5e69dffe2b54551d2487424448f1
- git.kernel.org/stable/c/4338b0f6544c3ff042bfbaf40bc9afe531fb08c7
- git.kernel.org/stable/c/6070123d5344d0950f10ef6a5fdc3f076abb7ad2
- git.kernel.org/stable/c/98520a9a3d69a530dd1ee280cbe0abc232a35bff
- git.kernel.org/stable/c/e422370e6ab28478872b914cee5d49a9bdfae0c6
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.37 ≤ v < 5.4.298, 5.5 ≤ v < 5.10.242, 5.11 ≤ v < 5.15.191, 5.16 ≤ v < 6.1.150, 6.2 ≤ v < 6.6.104, 6.7 ≤ v < 6.12.45, 6.13 ≤ v < 6.16.5, 6.17 | 5.4.298, 5.10.242, 5.15.191, 6.1.150, 6.6.104, 6.12.45, 6.16.5 |
| debian debian_linux | 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.