CVE-2025-39824

A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem, specifically within the ASUS HID driver. A local attacker with physical access could connect a specially crafted malicious HID device, such as an ASUS ROG N-Key keyboard, to trigger a use-after-free vulnerability. This occurs when a malformed descriptor causes the system to prematurely free memory that is later accessed. Successful exploitation of this flaw could lead to system instability, a denial of service (DoS), or potentially arbitrary code execution.

Exploiting this flaw requires that an attacker have physical access to the vulnerable system, and is able to connect a malicious input device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.