A Linux kernel HID driver fault allows a caller to trigger an out-of-bounds read when requesting a numbered report with a length of zero. The driver unconditionally dereferences the first byte of the data buffer before validating the length, so a size of zero permits reading beyond the buffer or can even cause a kernel panic. The flaw could expose kernel memory contents or disrupt kernel stability if exploited, affecting confidentiality, integrity, and availability of the system.

The vulnerability exists in all Linux kernel builds that contain the free-floating hid_get_report implementation without the size validation check. Since no specific version list is provided, any kernel prior to the fix – effectively any unsupported or older kernel release that has not been patched – would be affected. Administrators should verify whether their deployed kernels include the commit that moved the size validation before the dereference.

Risk and exploitability: The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. The flaw requires a caller to invoke hid_report_raw_event() with a size argument of zero. Based on the description, it is inferred that the attacker could achieve this by a local privileged process or by a malicious HID device if device credentials can be coerced. Because this constitutes an out-of-bounds read at kernel privilege level, exploitation could lead to kernel memory disclosure or a system crash. The attack vector is inferred to be local through user‑space actions or device interaction.