linux-cve-announce - CVE-2025-39808: HID: hid-ntrig: fix unable to handle page fault in ntrig_report

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091613-CVE-2025-39808-a964@gregkh>
Date: Tue, 16 Sep 2025 15:00:14 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-39808: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()

in ntrig_report_version(), hdev parameter passed from hid_probe().
sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null
if hdev->dev.parent->parent is null, usb_dev has
invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned
when usb_rcvctrlpipe() use usb_dev,it trigger
page fault error for address(0xffffffffffffff58)

add null check logic to ntrig_report_version()
before calling hid_to_usb_dev()

The Linux kernel CVE team has assigned CVE-2025-39808 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.4.298 with commit 22ddb5eca4af5e69dffe2b54551d2487424448f1
	Fixed in 5.10.242 with commit 019c34ca11372de891c06644846eb41fca7c890c
	Fixed in 5.15.191 with commit 4338b0f6544c3ff042bfbaf40bc9afe531fb08c7
	Fixed in 6.1.150 with commit 6070123d5344d0950f10ef6a5fdc3f076abb7ad2
	Fixed in 6.6.104 with commit e422370e6ab28478872b914cee5d49a9bdfae0c6
	Fixed in 6.12.45 with commit 98520a9a3d69a530dd1ee280cbe0abc232a35bff
	Fixed in 6.16.5 with commit 183def8e4d786e50165e5d992df6a3083e45e16c
	Fixed in 6.17-rc4 with commit 185c926283da67a72df20a63a5046b3b4631b7d9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-39808
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hid/hid-ntrig.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/22ddb5eca4af5e69dffe2b54551d2487424448f1
	https://git.kernel.org/stable/c/019c34ca11372de891c06644846eb41fca7c890c
	https://git.kernel.org/stable/c/4338b0f6544c3ff042bfbaf40bc9afe531fb08c7
	https://git.kernel.org/stable/c/6070123d5344d0950f10ef6a5fdc3f076abb7ad2
	https://git.kernel.org/stable/c/e422370e6ab28478872b914cee5d49a9bdfae0c6
	https://git.kernel.org/stable/c/98520a9a3d69a530dd1ee280cbe0abc232a35bff
	https://git.kernel.org/stable/c/183def8e4d786e50165e5d992df6a3083e45e16c
	https://git.kernel.org/stable/c/185c926283da67a72df20a63a5046b3b4631b7d9