CVE - CVE-2025-21794

CVE-ID
CVE-2025-21794	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints() Syzbot[1] has detected a stack-out-of-bounds read of the ep_addr array from hid-thrustmaster driver. This array is passed to usb_check_int_endpoints function from usb.c core driver, which executes a for loop that iterates over the elements of the passed array. Not finding a null element at the end of the array, it tries to read the next, non-existent element, crashing the kernel. To fix this, a 0 element was added at the end of the array to break the for loop. [1] https://syzkaller.appspot.com/bug?extid=9c9179ac46169c56c1ad
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/0b43d98ff29be3144e86294486b1373b5df74c0e URL:https://git.kernel.org/stable/c/0b43d98ff29be3144e86294486b1373b5df74c0e MISC:https://git.kernel.org/stable/c/436f48c864186e9413d1b7c6e91767cc9e1a65b8 URL:https://git.kernel.org/stable/c/436f48c864186e9413d1b7c6e91767cc9e1a65b8 MISC:https://git.kernel.org/stable/c/73e36a699b9f46322ffb81f072a24e64f728dba7 URL:https://git.kernel.org/stable/c/73e36a699b9f46322ffb81f072a24e64f728dba7 MISC:https://git.kernel.org/stable/c/cdd9a1ea23ff1a272547217100663e8de4eada40 URL:https://git.kernel.org/stable/c/cdd9a1ea23ff1a272547217100663e8de4eada40 MISC:https://git.kernel.org/stable/c/f3ce05283f6cb6e19c220f5382def43dc5bd56b9 URL:https://git.kernel.org/stable/c/f3ce05283f6cb6e19c220f5382def43dc5bd56b9
Assigning CNA
kernel.org
Date Record Created
20241229	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241229)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)