The flaw in the Linux kernel stems from an unsigned integer overflow (CWE‑190) in the HID‑BPF helper function hid_bpf_get_data(). When an attacker supplies an offset and size that, when summed, wrap around the unsigned boundary, the function mistakenly considers the requested range to be within the allocated buffer. Consequently it returns a pointer that points outside the legitimate bounds, resulting in an out‑of‑bounds read (CWE‑787) that exposes arbitrary kernel memory to the attacker. While this does not directly provide code execution, the ability to read kernel memory can facilitate further attacks such as bypassing kernel address space layout randomization or accelerating other exploits.

All Linux kernel installations that have not incorporated the commit that introduced the range‑check fix (commit hashes c2d044049, 61a959b82, ca373549, or f81bc5a709) are potentially vulnerable. The affected vendor is Linux; specific version details are not given in the CVE record, so any kernel build lacking the patch is at risk.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious HID device or crafted USB input that can invoke hid_bpf_get_data() with an oversized request, requiring that the kernel module or driver exposing the helper is present. While exploitation requires interacting with HID‑BPF functionality, the resulting kernel memory exposure can be critical if combined with other weaknesses. Overall, the risk is moderate to high for environments that allow untrusted HID devices or that rely on kernel modules with HID‑BPF access.