CVE-2025-38494

Q: What is the severity of CVE-2025-38494?

CVE-2025-38494 has a CVSS score of 7.8 (HIGH). A vulnerability in the Linux kernel's HID subsystem allows low-level transport drivers to bypass parameter validation in hid_hw_raw_request(). This could enable attackers with local access to pass invalid parameters that might lead to kernel crashes or potential privilege escalation. Systems running vulnerable Linux kernel versions with HID devices are affected.

7.8 HIGH

Denial of Service

📋 TL;DR

A vulnerability in the Linux kernel's HID subsystem allows low-level transport drivers to bypass parameter validation in hid_hw_raw_request(). This could enable attackers with local access to pass invalid parameters that might lead to kernel crashes or potential privilege escalation. Systems running vulnerable Linux kernel versions with HID devices are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable versions not specified in CVE, but patches exist in stable kernel trees.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires HID device support and local access to exploit. Impact depends on specific HID drivers and configurations.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation leading to full system compromise or kernel panic causing system instability.

🟠

Likely Case

Kernel crash (denial of service) or limited information disclosure from kernel memory.

🟢

If Mitigated

No impact if proper access controls prevent local attackers from accessing HID interfaces.

🌐 Internet-Facing: LOW - Requires local access to exploit.

🏢 Internal Only: MEDIUM - Local attackers or malicious insiders could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and knowledge of HID subsystem internals. No public exploit code identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (commits referenced in CVE)

Vendor Advisory: https://git.kernel.org/stable/c/0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81

Restart Required: Yes

Instructions:

1. Update to patched kernel version from your distribution's repository. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Restrict HID device access

linux

Limit access to HID devices using filesystem permissions or mandatory access controls.

chmod 600 /dev/hidraw*
setfacl -m u:root:rw /dev/hidraw*

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized users from accessing HID devices
Monitor system logs for unusual HID device activity or kernel crashes

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions from distribution vendor. Examine if HID subsystem is loaded.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version matches patched version from vendor. Check that HID devices function normally.

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crashes related to HID subsystem
Unusual HID device access in audit logs

Network Indicators:

Not applicable - local vulnerability

SIEM Query:

source="kernel" AND ("HID" OR "hid_hw_raw_request") AND ("panic" OR "oops" OR "segfault")

📊 Metadata

CVE ID: CVE-2025-38494

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score: 0.01% exploit probability (0.3th percentile)

Published: July 28, 2025

Last Updated: January 26, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Restrict HID device access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export