{"api_version":"1","generated_at":"2026-05-13T08:05:05+00:00","cve":"CVE-2025-39824","urls":{"html":"https://cve.report/CVE-2025-39824","api":"https://cve.report/api/cve/CVE-2025-39824.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-39824","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-39824"},"summary":{"title":"HID: asus: fix UAF via HID_CLAIMED_INPUT validation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: asus: fix UAF via HID_CLAIMED_INPUT validation\n\nAfter hid_hw_start() is called hidinput_connect() will eventually be\ncalled to set up the device with the input layer since the\nHID_CONNECT_DEFAULT connect mask is used. During hidinput_connect()\nall input and output reports are processed and corresponding hid_inputs\nare allocated and configured via hidinput_configure_usages(). This\nprocess involves slot tagging report fields and configuring usages\nby setting relevant bits in the capability bitmaps. However it is possible\nthat the capability bitmaps are not set at all leading to the subsequent\nhidinput_has_been_populated() check to fail leading to the freeing of the\nhid_input and the underlying input device.\n\nThis becomes problematic because a malicious HID device like a\nASUS ROG N-Key keyboard can trigger the above scenario via a\nspecially crafted descriptor which then leads to a user-after-free\nwhen the name of the freed input device is written to later on after\nhid_hw_start(). Below, report 93 intentionally utilises the\nHID_UP_UNDEFINED Usage Page which is skipped during usage\nconfiguration, leading to the frees.\n\n0x05, 0x0D,        // Usage Page (Digitizer)\n0x09, 0x05,        // Usage (Touch Pad)\n0xA1, 0x01,        // Collection (Application)\n0x85, 0x0D,        //   Report ID (13)\n0x06, 0x00, 0xFF,  //   Usage Page (Vendor Defined 0xFF00)\n0x09, 0xC5,        //   Usage (0xC5)\n0x15, 0x00,        //   Logical Minimum (0)\n0x26, 0xFF, 0x00,  //   Logical Maximum (255)\n0x75, 0x08,        //   Report Size (8)\n0x95, 0x04,        //   Report Count (4)\n0xB1, 0x02,        //   Feature (Data,Var,Abs)\n0x85, 0x5D,        //   Report ID (93)\n0x06, 0x00, 0x00,  //   Usage Page (Undefined)\n0x09, 0x01,        //   Usage (0x01)\n0x15, 0x00,        //   Logical Minimum (0)\n0x26, 0xFF, 0x00,  //   Logical Maximum (255)\n0x75, 0x08,        //   Report Size (8)\n0x95, 0x1B,        //   Report Count (27)\n0x81, 0x02,        //   Input (Data,Var,Abs)\n0xC0,              // End Collection\n\nBelow is the KASAN splat after triggering the UAF:\n\n[   21.672709] ==================================================================\n[   21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80\n[   21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54\n[   21.673700]\n[   21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary)\n[   21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n[   21.673700] Call Trace:\n[   21.673700]  <TASK>\n[   21.673700]  dump_stack_lvl+0x5f/0x80\n[   21.673700]  print_report+0xd1/0x660\n[   21.673700]  kasan_report+0xe5/0x120\n[   21.673700]  __asan_report_store8_noabort+0x1b/0x30\n[   21.673700]  asus_probe+0xeeb/0xf80\n[   21.673700]  hid_device_probe+0x2ee/0x700\n[   21.673700]  really_probe+0x1c6/0x6b0\n[   21.673700]  __driver_probe_device+0x24f/0x310\n[   21.673700]  driver_probe_device+0x4e/0x220\n[...]\n[   21.673700]\n[   21.673700] Allocated by task 54:\n[   21.673700]  kasan_save_stack+0x3d/0x60\n[   21.673700]  kasan_save_track+0x18/0x40\n[   21.673700]  kasan_save_alloc_info+0x3b/0x50\n[   21.673700]  __kasan_kmalloc+0x9c/0xa0\n[   21.673700]  __kmalloc_cache_noprof+0x139/0x340\n[   21.673700]  input_allocate_device+0x44/0x370\n[   21.673700]  hidinput_connect+0xcb6/0x2630\n[   21.673700]  hid_connect+0xf74/0x1d60\n[   21.673700]  hid_hw_start+0x8c/0x110\n[   21.673700]  asus_probe+0x5a3/0xf80\n[   21.673700]  hid_device_probe+0x2ee/0x700\n[   21.673700]  really_probe+0x1c6/0x6b0\n[   21.673700]  __driver_probe_device+0x24f/0x310\n[   21.673700]  driver_probe_device+0x4e/0x220\n[...]\n[   21.673700]\n[   21.673700] Freed by task 54:\n[   21.673700]  kasan_save_stack+0x3d/0x60\n[   21.673700]  kasan_save_track+0x18/0x40\n[   21.673700]  kasan_save_free_info+0x3f/0x60\n[   21.673700]  __kasan_slab_free+0x3c/0x50\n[   21.673700]  kfre\n---truncated---","state":"PUBLISHED","assigner":"Linux","published_at":"2025-09-16 13:16:01","updated_at":"2026-05-12 13:17:13"},"problem_types":["CWE-416"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/9a9e4a8317437bf944fa017c66e1e23a0368b5c7","name":"https://git.kernel.org/stable/c/9a9e4a8317437bf944fa017c66e1e23a0368b5c7","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c0d77e3441a92d0b4958193c9ac1c3f81c6f1d1c","name":"https://git.kernel.org/stable/c/c0d77e3441a92d0b4958193c9ac1c3f81c6f1d1c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","name":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/eaae728e7335b5dbad70966e2bd520a731fdf7b2","name":"https://git.kernel.org/stable/c/eaae728e7335b5dbad70966e2bd520a731fdf7b2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5","name":"https://git.kernel.org/stable/c/7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","name":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","refsource":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c","name":"https://git.kernel.org/stable/c/a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5f3c0839b173f7f33415eb098331879e547d1d2d","name":"https://git.kernel.org/stable/c/5f3c0839b173f7f33415eb098331879e547d1d2d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/72a4ec018c9e9bc52f4f80eb3afb5d6a6b752275","name":"https://git.kernel.org/stable/c/72a4ec018c9e9bc52f4f80eb3afb5d6a6b752275","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4","name":"https://git.kernel.org/stable/c/d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","name":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-39824","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39824","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ce12d8be12c94334634dd57050444910415e45f 9a9e4a8317437bf944fa017c66e1e23a0368b5c7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ce12d8be12c94334634dd57050444910415e45f 7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ce12d8be12c94334634dd57050444910415e45f eaae728e7335b5dbad70966e2bd520a731fdf7b2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ce12d8be12c94334634dd57050444910415e45f a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ce12d8be12c94334634dd57050444910415e45f 5f3c0839b173f7f33415eb098331879e547d1d2d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ce12d8be12c94334634dd57050444910415e45f c0d77e3441a92d0b4958193c9ac1c3f81c6f1d1c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ce12d8be12c94334634dd57050444910415e45f 72a4ec018c9e9bc52f4f80eb3afb5d6a6b752275 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ce12d8be12c94334634dd57050444910415e45f d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.10","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.10 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.298 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.242 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.191 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.150 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.104 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.45 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16.5 6.16.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17 * original_commit_for_fix","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC CN 4100","version":"affected V5.0 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"39824","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2025-11-03T17:43:45.289Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"title":"CVE Program Container"},{"affected":[{"defaultStatus":"unknown","product":"SIMATIC CN 4100","vendor":"Siemens","versions":[{"lessThan":"V5.0","status":"affected","version":"0","versionType":"custom"}]}],"providerMetadata":{"dateUpdated":"2026-05-12T12:07:19.349Z","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP"},"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}],"x_adpType":"supplier"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-asus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9a9e4a8317437bf944fa017c66e1e23a0368b5c7","status":"affected","version":"9ce12d8be12c94334634dd57050444910415e45f","versionType":"git"},{"lessThan":"7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5","status":"affected","version":"9ce12d8be12c94334634dd57050444910415e45f","versionType":"git"},{"lessThan":"eaae728e7335b5dbad70966e2bd520a731fdf7b2","status":"affected","version":"9ce12d8be12c94334634dd57050444910415e45f","versionType":"git"},{"lessThan":"a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c","status":"affected","version":"9ce12d8be12c94334634dd57050444910415e45f","versionType":"git"},{"lessThan":"5f3c0839b173f7f33415eb098331879e547d1d2d","status":"affected","version":"9ce12d8be12c94334634dd57050444910415e45f","versionType":"git"},{"lessThan":"c0d77e3441a92d0b4958193c9ac1c3f81c6f1d1c","status":"affected","version":"9ce12d8be12c94334634dd57050444910415e45f","versionType":"git"},{"lessThan":"72a4ec018c9e9bc52f4f80eb3afb5d6a6b752275","status":"affected","version":"9ce12d8be12c94334634dd57050444910415e45f","versionType":"git"},{"lessThan":"d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4","status":"affected","version":"9ce12d8be12c94334634dd57050444910415e45f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-asus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.298","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.242","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.191","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.150","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.104","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.45","versionType":"semver"},{"lessThanOrEqual":"6.16.*","status":"unaffected","version":"6.16.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.17","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.298","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.242","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.191","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.150","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.104","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.45","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.16.5","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17","versionStartIncluding":"4.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: asus: fix UAF via HID_CLAIMED_INPUT validation\n\nAfter hid_hw_start() is called hidinput_connect() will eventually be\ncalled to set up the device with the input layer since the\nHID_CONNECT_DEFAULT connect mask is used. During hidinput_connect()\nall input and output reports are processed and corresponding hid_inputs\nare allocated and configured via hidinput_configure_usages(). This\nprocess involves slot tagging report fields and configuring usages\nby setting relevant bits in the capability bitmaps. However it is possible\nthat the capability bitmaps are not set at all leading to the subsequent\nhidinput_has_been_populated() check to fail leading to the freeing of the\nhid_input and the underlying input device.\n\nThis becomes problematic because a malicious HID device like a\nASUS ROG N-Key keyboard can trigger the above scenario via a\nspecially crafted descriptor which then leads to a user-after-free\nwhen the name of the freed input device is written to later on after\nhid_hw_start(). Below, report 93 intentionally utilises the\nHID_UP_UNDEFINED Usage Page which is skipped during usage\nconfiguration, leading to the frees.\n\n0x05, 0x0D,        // Usage Page (Digitizer)\n0x09, 0x05,        // Usage (Touch Pad)\n0xA1, 0x01,        // Collection (Application)\n0x85, 0x0D,        //   Report ID (13)\n0x06, 0x00, 0xFF,  //   Usage Page (Vendor Defined 0xFF00)\n0x09, 0xC5,        //   Usage (0xC5)\n0x15, 0x00,        //   Logical Minimum (0)\n0x26, 0xFF, 0x00,  //   Logical Maximum (255)\n0x75, 0x08,        //   Report Size (8)\n0x95, 0x04,        //   Report Count (4)\n0xB1, 0x02,        //   Feature (Data,Var,Abs)\n0x85, 0x5D,        //   Report ID (93)\n0x06, 0x00, 0x00,  //   Usage Page (Undefined)\n0x09, 0x01,        //   Usage (0x01)\n0x15, 0x00,        //   Logical Minimum (0)\n0x26, 0xFF, 0x00,  //   Logical Maximum (255)\n0x75, 0x08,        //   Report Size (8)\n0x95, 0x1B,        //   Report Count (27)\n0x81, 0x02,        //   Input (Data,Var,Abs)\n0xC0,              // End Collection\n\nBelow is the KASAN splat after triggering the UAF:\n\n[   21.672709] ==================================================================\n[   21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80\n[   21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54\n[   21.673700]\n[   21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary)\n[   21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n[   21.673700] Call Trace:\n[   21.673700]  <TASK>\n[   21.673700]  dump_stack_lvl+0x5f/0x80\n[   21.673700]  print_report+0xd1/0x660\n[   21.673700]  kasan_report+0xe5/0x120\n[   21.673700]  __asan_report_store8_noabort+0x1b/0x30\n[   21.673700]  asus_probe+0xeeb/0xf80\n[   21.673700]  hid_device_probe+0x2ee/0x700\n[   21.673700]  really_probe+0x1c6/0x6b0\n[   21.673700]  __driver_probe_device+0x24f/0x310\n[   21.673700]  driver_probe_device+0x4e/0x220\n[...]\n[   21.673700]\n[   21.673700] Allocated by task 54:\n[   21.673700]  kasan_save_stack+0x3d/0x60\n[   21.673700]  kasan_save_track+0x18/0x40\n[   21.673700]  kasan_save_alloc_info+0x3b/0x50\n[   21.673700]  __kasan_kmalloc+0x9c/0xa0\n[   21.673700]  __kmalloc_cache_noprof+0x139/0x340\n[   21.673700]  input_allocate_device+0x44/0x370\n[   21.673700]  hidinput_connect+0xcb6/0x2630\n[   21.673700]  hid_connect+0xf74/0x1d60\n[   21.673700]  hid_hw_start+0x8c/0x110\n[   21.673700]  asus_probe+0x5a3/0xf80\n[   21.673700]  hid_device_probe+0x2ee/0x700\n[   21.673700]  really_probe+0x1c6/0x6b0\n[   21.673700]  __driver_probe_device+0x24f/0x310\n[   21.673700]  driver_probe_device+0x4e/0x220\n[...]\n[   21.673700]\n[   21.673700] Freed by task 54:\n[   21.673700]  kasan_save_stack+0x3d/0x60\n[   21.673700]  kasan_save_track+0x18/0x40\n[   21.673700]  kasan_save_free_info+0x3f/0x60\n[   21.673700]  __kasan_slab_free+0x3c/0x50\n[   21.673700]  kfre\n---truncated---"}],"providerMetadata":{"dateUpdated":"2026-05-11T21:37:04.375Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/9a9e4a8317437bf944fa017c66e1e23a0368b5c7"},{"url":"https://git.kernel.org/stable/c/7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5"},{"url":"https://git.kernel.org/stable/c/eaae728e7335b5dbad70966e2bd520a731fdf7b2"},{"url":"https://git.kernel.org/stable/c/a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c"},{"url":"https://git.kernel.org/stable/c/5f3c0839b173f7f33415eb098331879e547d1d2d"},{"url":"https://git.kernel.org/stable/c/c0d77e3441a92d0b4958193c9ac1c3f81c6f1d1c"},{"url":"https://git.kernel.org/stable/c/72a4ec018c9e9bc52f4f80eb3afb5d6a6b752275"},{"url":"https://git.kernel.org/stable/c/d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4"}],"title":"HID: asus: fix UAF via HID_CLAIMED_INPUT validation","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-39824","datePublished":"2025-09-16T13:00:23.135Z","dateReserved":"2025-04-16T07:20:57.139Z","dateUpdated":"2026-05-12T12:07:19.349Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-09-16 13:16:01","lastModifiedDate":"2026-05-12 13:17:13","problem_types":["CWE-416"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.4.298","matchCriteriaId":"92AEA158-0437-4D82-AE9B-763439A87C91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.242","matchCriteriaId":"CFAE7D1D-31D7-4259-8581-3CB64D12DE3B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.191","matchCriteriaId":"A532F1D1-B7A9-4745-AB0E-B6AD12CAD0BD"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.150","matchCriteriaId":"67AC87D5-97BF-4617-92EF-9E282B6D1CF7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.104","matchCriteriaId":"FD12E3C3-F737-4936-9A57-80832E36D22F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.45","matchCriteriaId":"DC443D7D-A411-41FB-BB45-010F36EF7C94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.16.5","matchCriteriaId":"EB781080-7001-4FA1-B388-517FFEFBC73E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*","matchCriteriaId":"327D22EF-390B-454C-BD31-2ED23C998A1C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*","matchCriteriaId":"C730CD9A-D969-4A8E-9522-162AAF7C0EE9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*","matchCriteriaId":"39982C4B-716E-4B2F-8196-FA301F47807D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"39824","Ordinal":"1","Title":"HID: asus: fix UAF via HID_CLAIMED_INPUT validation","CVE":"CVE-2025-39824","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"39824","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: asus: fix UAF via HID_CLAIMED_INPUT validation\n\nAfter hid_hw_start() is called hidinput_connect() will eventually be\ncalled to set up the device with the input layer since the\nHID_CONNECT_DEFAULT connect mask is used. During hidinput_connect()\nall input and output reports are processed and corresponding hid_inputs\nare allocated and configured via hidinput_configure_usages(). This\nprocess involves slot tagging report fields and configuring usages\nby setting relevant bits in the capability bitmaps. However it is possible\nthat the capability bitmaps are not set at all leading to the subsequent\nhidinput_has_been_populated() check to fail leading to the freeing of the\nhid_input and the underlying input device.\n\nThis becomes problematic because a malicious HID device like a\nASUS ROG N-Key keyboard can trigger the above scenario via a\nspecially crafted descriptor which then leads to a user-after-free\nwhen the name of the freed input device is written to later on after\nhid_hw_start(). Below, report 93 intentionally utilises the\nHID_UP_UNDEFINED Usage Page which is skipped during usage\nconfiguration, leading to the frees.\n\n0x05, 0x0D,        // Usage Page (Digitizer)\n0x09, 0x05,        // Usage (Touch Pad)\n0xA1, 0x01,        // Collection (Application)\n0x85, 0x0D,        //   Report ID (13)\n0x06, 0x00, 0xFF,  //   Usage Page (Vendor Defined 0xFF00)\n0x09, 0xC5,        //   Usage (0xC5)\n0x15, 0x00,        //   Logical Minimum (0)\n0x26, 0xFF, 0x00,  //   Logical Maximum (255)\n0x75, 0x08,        //   Report Size (8)\n0x95, 0x04,        //   Report Count (4)\n0xB1, 0x02,        //   Feature (Data,Var,Abs)\n0x85, 0x5D,        //   Report ID (93)\n0x06, 0x00, 0x00,  //   Usage Page (Undefined)\n0x09, 0x01,        //   Usage (0x01)\n0x15, 0x00,        //   Logical Minimum (0)\n0x26, 0xFF, 0x00,  //   Logical Maximum (255)\n0x75, 0x08,        //   Report Size (8)\n0x95, 0x1B,        //   Report Count (27)\n0x81, 0x02,        //   Input (Data,Var,Abs)\n0xC0,              // End Collection\n\nBelow is the KASAN splat after triggering the UAF:\n\n[   21.672709] ==================================================================\n[   21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80\n[   21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54\n[   21.673700]\n[   21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary)\n[   21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n[   21.673700] Call Trace:\n[   21.673700]  <TASK>\n[   21.673700]  dump_stack_lvl+0x5f/0x80\n[   21.673700]  print_report+0xd1/0x660\n[   21.673700]  kasan_report+0xe5/0x120\n[   21.673700]  __asan_report_store8_noabort+0x1b/0x30\n[   21.673700]  asus_probe+0xeeb/0xf80\n[   21.673700]  hid_device_probe+0x2ee/0x700\n[   21.673700]  really_probe+0x1c6/0x6b0\n[   21.673700]  __driver_probe_device+0x24f/0x310\n[   21.673700]  driver_probe_device+0x4e/0x220\n[...]\n[   21.673700]\n[   21.673700] Allocated by task 54:\n[   21.673700]  kasan_save_stack+0x3d/0x60\n[   21.673700]  kasan_save_track+0x18/0x40\n[   21.673700]  kasan_save_alloc_info+0x3b/0x50\n[   21.673700]  __kasan_kmalloc+0x9c/0xa0\n[   21.673700]  __kmalloc_cache_noprof+0x139/0x340\n[   21.673700]  input_allocate_device+0x44/0x370\n[   21.673700]  hidinput_connect+0xcb6/0x2630\n[   21.673700]  hid_connect+0xf74/0x1d60\n[   21.673700]  hid_hw_start+0x8c/0x110\n[   21.673700]  asus_probe+0x5a3/0xf80\n[   21.673700]  hid_device_probe+0x2ee/0x700\n[   21.673700]  really_probe+0x1c6/0x6b0\n[   21.673700]  __driver_probe_device+0x24f/0x310\n[   21.673700]  driver_probe_device+0x4e/0x220\n[...]\n[   21.673700]\n[   21.673700] Freed by task 54:\n[   21.673700]  kasan_save_stack+0x3d/0x60\n[   21.673700]  kasan_save_track+0x18/0x40\n[   21.673700]  kasan_save_free_info+0x3f/0x60\n[   21.673700]  __kasan_slab_free+0x3c/0x50\n[   21.673700]  kfre\n---truncated---","Type":"Description","Title":"HID: asus: fix UAF via HID_CLAIMED_INPUT validation"}]}}}