CVE-2025-39806: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
Published Sep 16, 2025
·Updated
HID: multitouch: fix slab out-of-bounds access in mtreportfixup()
Affected Software
20 affected componentsFixes available
linux_kernel>6.15.0-00005-gec5d573d83f4-dirty
Microsoft cbl2 kernel 5.15.186.1-1
Linux Linux kernel>=5.15.168<5.15.191
Linux Linux kernel>=6.1.111<6.1.150
Linux Linux kernel>=6.6.52<6.6.104
Linux Linux kernel>=6.10.11<6.11
Linux Linux kernel>=6.11.1<6.12.45
Linux Linux kernel>=6.13<6.16.5
Linux Linux kernel=6.11
Linux Linux kernel=6.11-rc5
Linux Linux kernel=6.11-rc6
Linux Linux kernel=6.11-rc7
Linux Linux kernel=6.17-rc1
Linux Linux kernel=6.17-rc2
Linux Linux kernel=6.17-rc3
Debian Debian Linux=11.0
IBM Verify Identity Access<=11.0 - 11.0.2
IBM Security Verify Access<=10.0 - 10.0.9.1
IBM Verify Identity Access Container<=11.0 - 11.0.2
IBM Security Verify Access Container<=10.0 - 10.0.9.1
Event History
Sep 16, 2025
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
Description
Data Sourced
via NVD·01:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·02:03 PM
DescriptionSeverityAffected Software
Jan 18, 2026
Data Sourced
via Microsoft·09:02 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·09:02 AM
Affected Software
Updated
via Microsoft·09:02 AM
DescriptionSeverity
Jul 8, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-39806?
CVE-2025-39806 has been classified as a high severity vulnerability due to the potential for slab out-of-bounds access.
2
How do I fix CVE-2025-39806?
To fix CVE-2025-39806, update your Linux kernel to a version that includes the patch addressing this vulnerability.
3
What causes the vulnerability CVE-2025-39806?
CVE-2025-39806 is caused by a malicious HID device that can trigger slab out-of-bounds access in the mt_report_fixup() function by passing a report descriptor smaller than 607 bytes.
4
Which versions of the Linux Kernel are affected by CVE-2025-39806?
CVE-2025-39806 affects Linux Kernel versions prior to 607.
5
Is CVE-2025-39806 related to HID devices?
Yes, CVE-2025-39806 specifically relates to vulnerabilities triggered by malicious HID devices.