An out‑of‑bounds read in the Linux kernel HID core occurs when a caller invokes hid_report_raw_event() with a size of zero for a numbered report. The kernel function hid_get_report() dereferences the first byte of the data buffer before validating the length, which can allow a malicious actor to read memory beyond the supplied buffer or, in the worst case, trigger a kernel panic.

The vulnerability is present in any Linux kernel build that contains the pre‑fix implementation of hid_get_report(), i.e., all kernels released before the commit that moves the size validation before the data dereference. System administrators should determine if their running kernel includes the change, typically by checking the kernel version against the public commit series or by inspecting the source for the size check movement.

The CVSS score of 8.8 reflects a high impact of the vulnerability. The EPSS score of < 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; based on the description, it is inferred that an attacker would need to trigger hid_report_raw_event() with a zero length argument, which may be achievable by a user with elevated privileges or by a malicious HID device that can issue raw events. The kernel privilege level of the code makes this a serious confidentiality and availability risk.