In the Linux kernel, the function s32ton() performs a left shift by (report_size‑1) where report_size comes directly from a HID device report descriptor. Because HID parsers limit report_size only to 256, a malicious device can supply a descriptor that causes a shift of 255 positions on a 32‑bit type. This results in an undefined shift operation, which can corrupt kernel memory or cause a crash. The vulnerability is classified as a shift‑overflow weakness (CWE‑1335) and can lead to a denial of service by causing a kernel panic when processing output reports for HID devices.

All Linux kernel releases that include the Linux HID core before the removal of the unchecked shift in s32ton() are affected. Versions that do not contain the commit that clamps the shifting (currently present only in the kernel master as of commit ec61b41918587) can be impacted. The vulnerability affects the kernel's HID subsystem and therefore any system that accepts HID devices such as keyboards, mice, game controllers, or custom USB HID devices. Vendor identification is Linux for all affected builds.

The CVSS score of 5.5 indicates a moderate severity risk, but the EPSS score of <1% suggests that this bug is unlikely to be actively exploited in the wild. It is not listed in the CISA Known‑Exploited Vulnerabilities catalog. The vulnerability requires an attacker to supply a crafted HID report descriptor via a physical or virtual HID device, which typically limits exposure to environments with arbitrary device injection capabilities. Consequently, the risk is high for systems that run unpatched kernels and host unfiltered HID devices, but the practical exploitation window is narrow.