CVE-2025-39818: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
In the Linux kernel, the following vulnerability has been resolved:
HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Improper use of secondary pointer (&dev->i2csubipregs) caused kernel crash and out-of-bounds error:
BUG: KASAN: slab-out-of-bounds in regmapbulkread+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107
CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async asyncrunentryfn Call Trace: <TASK> dumpstacklvl+0x76/0xa0 printreport+0xd1/0x660 ? pfxrawspinlockirqsave+0x10/0x10 ? kasancompletemodereportinfo+0x26/0x200 kasanreport+0xe1/0x120 ? regmapbulkread+0x449/0x510 ? regmapbulkread+0x449/0x510 asanreportstore4noabort+0x17/0x30 regmapbulkread+0x449/0x510 ? pfxregmapbulkread+0x10/0x10 regmapbulkread+0x270/0x3d0 piocomplete+0x1ee/0x2c0 [intelthc] ? pfxpiocomplete+0x10/0x10 [intelthc] ? pfxpiowait+0x10/0x10 [intelthc] ? regmapupdatebitsbase+0x13b/0x1f0 thci2csubippioread+0x117/0x270 [intelthc] thci2csubipregssave+0xc2/0x140 [intelthc] ? pfxthci2csubipregssave+0x10/0x10 [intelthc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0)
Replaced with direct array indexing (&dev->i2csubipregs[i]) to ensure safe memory access.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Improper use of secondary pointer (&dev-i2csubipregs) caused kernel crash and out-of-bounds error:
BUG: KASAN: slab-out-of-bounds in regmapbulkread+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107
CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async asyncrunentryfn Call Trace: TASK dumpstacklvl+0x76/0xa0 printreport+0xd1/0x660 ? pfxrawspinlockirqsave+0x10/0x10 ? kasancompletemodereportinfo+0x26/0x200 kasanreport+0xe1/0x120 ? regmapbulkread+0x449/0x510 ? regmapbulkread+0x449/0x510 asanreportstore4noabort+0x17/0x30 regmapbulkread+0x449/0x510 ? pfxregmapbulkread+0x10/0x10 regmapbulkread+0x270/0x3d0 piocomplete+0x1ee/0x2c0 [intelthc] ? pfxpiocomplete+0x10/0x10 [intelthc] ? pfxpiowait+0x10/0x10 [intelthc] ? regmapupdatebitsbase+0x13b/0x1f0 thci2csubippioread+0x117/0x270 [intelthc] thci2csubipregssave+0xc2/0x140 [intelthc] ? pfxthci2csubipregssave+0x10/0x10 [intelthc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0)
Replaced with direct array indexing (&dev-i2csubipregs[i]) to ensure safe memory access.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39818?
CVE-2025-39818 has a high severity rating due to potential kernel crashes and out-of-bounds errors.
How do I fix CVE-2025-39818?
To fix CVE-2025-39818, you should update the Linux kernel to version 6.16.1 or later where the vulnerability has been resolved.
Which versions of the Linux kernel are affected by CVE-2025-39818?
CVE-2025-39818 affects Linux kernel versions starting from 6.16.0.
What are the implications of CVE-2025-39818 for system stability?
CVE-2025-39818 could lead to system instability and crashes due to improper pointer arithmetic.
Is CVE-2025-39818 being actively exploited?
As of now, there is no public information indicating active exploitation of CVE-2025-39818.