{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39818", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.138Z", "datePublished": "2025-09-16T13:00:18.490Z", "dateUpdated": "2026-08-05T12:05:24.894Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:24.894Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save\n\nImproper use of secondary pointer (&dev->i2c_subip_regs) caused\nkernel crash and out-of-bounds error:\n\n BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510\n Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107\n\n CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)\n Workqueue: async async_run_entry_fn\n Call Trace:\n \n dump_stack_lvl+0x76/0xa0\n print_report+0xd1/0x660\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? kasan_complete_mode_report_info+0x26/0x200\n kasan_report+0xe1/0x120\n ? _regmap_bulk_read+0x449/0x510\n ? _regmap_bulk_read+0x449/0x510\n __asan_report_store4_noabort+0x17/0x30\n _regmap_bulk_read+0x449/0x510\n ? __pfx__regmap_bulk_read+0x10/0x10\n regmap_bulk_read+0x270/0x3d0\n pio_complete+0x1ee/0x2c0 [intel_thc]\n ? __pfx_pio_complete+0x10/0x10 [intel_thc]\n ? __pfx_pio_wait+0x10/0x10 [intel_thc]\n ? regmap_update_bits_base+0x13b/0x1f0\n thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]\n thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]\n ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]\n[...]\n The buggy address belongs to the object at ffff888136005d00\n which belongs to the cache kmalloc-rnd-12-192 of size 192\n The buggy address is located 0 bytes to the right of\n allocated 192-byte region [ffff888136005d00, ffff888136005dc0)\n\nReplaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure\nsafe memory access." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is in a PCI HID driver's system-suspend callback, reachable only from the local machine by triggering a suspend (logind/systemctl suspend, lid close, or idle timeout). There is no network or remote-peer input path to `thc_i2c_subip_regs_save()`.\nAC:L - The bad pointer arithmetic is unconditional — every single suspend on affected Intel THC I2C hardware writes 60 bytes at the wrong address, ~40 of them past the end of the slab object, with no race or timing dependency. Heap grooming to place a chosen victim object in the adjacent kmalloc-192 slot is standard and under attacker control.\nPR:L - An unprivileged local user with an active session can initiate system suspend via systemd-logind, which default polkit policy grants to active local sessions without root. No CAP_SYS_ADMIN or `/sys/power/state` write access is needed, and the path is additionally reached by automatic idle suspend.\nUI:N - The attacker triggers the suspend themselves; no separate victim needs to take any action. The bug also fires on unattended idle or lid-close suspend with no user involvement at all.\nS:U - The out-of-bounds write corrupts kernel slab memory within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The restore path performs a matching ~40-byte out-of-bounds read of the adjacent heap object and pushes it into hardware registers, and the OOB write can corrupt a groomed neighbouring object's length or pointer fields to yield an arbitrary-read primitive. Per kernel guidance, unbounded OOB access and memory corruption leverageable for disclosure score High.\nI:H - This is a slab out-of-bounds write of roughly 40 bytes past the allocation into an adjacent heap object, which also silently corrupts `struct thc_device`'s own tail fields including the `i2c_subip_regs` pointer. Out-of-bounds heap writes are scored High because heap grooming can direct the corruption at security-relevant fields.\nA:H - The commit message and KASAN trace explicitly document a kernel crash from this out-of-bounds write, and it recurs on every suspend cycle. Corruption of the adjacent slab object plus programming garbage into live I2C controller registers on resume also renders the touch input device inoperable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c" ], "versions": [ { "version": "4228966def884c6e34b85cdc7118c5d013e1718f", "lessThan": "78d4cf0466c79452e47aa6f720afbde63e709ccc", "status": "affected", "versionType": "git" }, { "version": "4228966def884c6e34b85cdc7118c5d013e1718f", "lessThan": "a7fc15ed629be89e51e09b743277c53e0a0168f5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c" ], "versions": [ { "version": "6.14", "status": "affected" }, { "version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.5", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.16.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/78d4cf0466c79452e47aa6f720afbde63e709ccc" }, { "url": "https://git.kernel.org/stable/c/a7fc15ed629be89e51e09b743277c53e0a0168f5" } ], "title": "HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-39818", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-01-14T18:16:14.710756Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T18:22:55.882Z" } } ] } }