In the Linux kernel HID subsystem, a call to memset() was used to clear data beyond an incoming report's length. Because the report length was unchecked, the memset could write past the buffer, corrupting kernel memory. An attacker who can supply a crafted HID event can trigger this out‑of-bounds write, potentially causing a kernel crash or enabling privilege escalation (CWE‑125).

All Linux kernel builds prior to the commit that removed the bogus memset are affected. The fix is included in the kernel revisions following the commits linked in the advisory; distributions that have updated kernels after those changes are safe. Older kernels remain vulnerable.

An exploit requires local or privileged access to a HID device that the kernel processes. The CVSS score of 8.8 indicates high severity, but the EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog. Despite this, kernel memory corruption can lead to privilege escalation or denial of service if an attacker can inject HID events. The risk is significant without re‑patching.