CVE-2025-38494

In the Linux kernel, the following vulnerability has been resolved:

HID: core: do not bypass hid_hw_raw_request

hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access with elevated privileges, restricting the attack vector and precluding remote exploitation. Under standard Red Hat configurations, interaction with raw human interface device transports is restricted to administrative users or physical device interfaces. A privileged local user exploiting this flaw could bypass kernel buffer validation checks during raw device communication, potentially causing a kernel panic or localized information exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.