The Linux kernel’s HID core parsing functions suffered a type confusion flaw. When a descriptor contains a long-format HID global item, the code stores a pointer instead of numeric data. Subsequent extraction routines mistakenly interpret that pointer as an integer, causing the lower portion of a kernel address to be printed to the kernel log. Because the address is exposed in dmesg, an attacker who can supply or alter a HID descriptor can gain information about the kernel address space.

All Linux kernels running a version before the commit that addresses the HID parsing bug are affected. The issue is present in the generic Linux kernel code and is independent of distribution. Any system that loads a vulnerable kernel and encounters a HID device with a long-format descriptor may trigger the leak.

The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available. An attacker with the ability to supply HID descriptors to a system can trigger a log entry that leaks a partial kernel address. The direct impact is information disclosure; it does not grant code execution but can serve as a foothold for more serious attacks. The overall risk is moderate based on the information available.