In the Linux kernel HID subsystem, a memset call was used to clear data beyond an incoming report’s length. Because the report length was unchecked, the memset could write past the allocated buffer, corrupting kernel memory. Kernel memory corruption can lead to a crash or, depending on the context, privilege escalation.

All Linux kernel builds prior to the commit that removed the bogus memset are potentially vulnerable. The fix is included in the kernel revisions following the commits linked in the advisory; distributions that have updated kernels after those changes are safe. Older kernels remain vulnerable.

The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% shows a low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. The vulnerability is triggered during the processing of HID events; therefore the likely attack vector is a local user who can send crafted HID input to the kernel, which may trigger the out-of-bounds write. No known public exploits have been reported yet.