CVE-2025-39818 (GCVE-0-2025-39818)

Vulnerability from cvelistv5 – Published: 2025-09-16 13:00 – Updated: 2026-08-05 12:05
VLAI
Title
HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4228966def884c6e34b85cdc7118c5d013e1718f , < 78d4cf0466c79452e47aa6f720afbde63e709ccc (git)
Affected: 4228966def884c6e34b85cdc7118c5d013e1718f , < a7fc15ed629be89e51e09b743277c53e0a0168f5 (git)
Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.16.5 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:16:14.710756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:22:55.882Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78d4cf0466c79452e47aa6f720afbde63e709ccc",
              "status": "affected",
              "version": "4228966def884c6e34b85cdc7118c5d013e1718f",
              "versionType": "git"
            },
            {
              "lessThan": "a7fc15ed629be89e51e09b743277c53e0a0168f5",
              "status": "affected",
              "version": "4228966def884c6e34b85cdc7118c5d013e1718f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.5",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save\n\nImproper use of secondary pointer (\u0026dev-\u003ei2c_subip_regs) caused\nkernel crash and out-of-bounds error:\n\n BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510\n Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107\n\n CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)\n Workqueue: async async_run_entry_fn\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x76/0xa0\n  print_report+0xd1/0x660\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? kasan_complete_mode_report_info+0x26/0x200\n  kasan_report+0xe1/0x120\n  ? _regmap_bulk_read+0x449/0x510\n  ? _regmap_bulk_read+0x449/0x510\n  __asan_report_store4_noabort+0x17/0x30\n  _regmap_bulk_read+0x449/0x510\n  ? __pfx__regmap_bulk_read+0x10/0x10\n  regmap_bulk_read+0x270/0x3d0\n  pio_complete+0x1ee/0x2c0 [intel_thc]\n  ? __pfx_pio_complete+0x10/0x10 [intel_thc]\n  ? __pfx_pio_wait+0x10/0x10 [intel_thc]\n  ? regmap_update_bits_base+0x13b/0x1f0\n  thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]\n  thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]\n  ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]\n[...]\n The buggy address belongs to the object at ffff888136005d00\n  which belongs to the cache kmalloc-rnd-12-192 of size 192\n The buggy address is located 0 bytes to the right of\n  allocated 192-byte region [ffff888136005d00, ffff888136005dc0)\n\nReplaced with direct array indexing (\u0026dev-\u003ei2c_subip_regs[i]) to ensure\nsafe memory access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is in a PCI HID driver\u0027s system-suspend callback, reachable only from the local machine by triggering a suspend (logind/systemctl suspend, lid close, or idle timeout). There is no network or remote-peer input path to `thc_i2c_subip_regs_save()`.\nAC:L - The bad pointer arithmetic is unconditional \u2014 every single suspend on affected Intel THC I2C hardware writes 60 bytes at the wrong address, ~40 of them past the end of the slab object, with no race or timing dependency. Heap grooming to place a chosen victim object in the adjacent kmalloc-192 slot is standard and under attacker control.\nPR:L - An unprivileged local user with an active session can initiate system suspend via systemd-logind, which default polkit policy grants to active local sessions without root. No CAP_SYS_ADMIN or `/sys/power/state` write access is needed, and the path is additionally reached by automatic idle suspend.\nUI:N - The attacker triggers the suspend themselves; no separate victim needs to take any action. The bug also fires on unattended idle or lid-close suspend with no user involvement at all.\nS:U - The out-of-bounds write corrupts kernel slab memory within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The restore path performs a matching ~40-byte out-of-bounds read of the adjacent heap object and pushes it into hardware registers, and the OOB write can corrupt a groomed neighbouring object\u0027s length or pointer fields to yield an arbitrary-read primitive. Per kernel guidance, unbounded OOB access and memory corruption leverageable for disclosure score High.\nI:H - This is a slab out-of-bounds write of roughly 40 bytes past the allocation into an adjacent heap object, which also silently corrupts `struct thc_device`\u0027s own tail fields including the `i2c_subip_regs` pointer. Out-of-bounds heap writes are scored High because heap grooming can direct the corruption at security-relevant fields.\nA:H - The commit message and KASAN trace explicitly document a kernel crash from this out-of-bounds write, and it recurs on every suspend cycle. Corruption of the adjacent slab object plus programming garbage into live I2C controller registers on resume also renders the touch input device inoperable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:24.894Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78d4cf0466c79452e47aa6f720afbde63e709ccc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7fc15ed629be89e51e09b743277c53e0a0168f5"
        }
      ],
      "title": "HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39818",
    "datePublished": "2025-09-16T13:00:18.490Z",
    "dateReserved": "2025-04-16T07:20:57.138Z",
    "dateUpdated": "2026-08-05T12:05:24.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39818",
      "date": "2026-08-06",
      "epss": "0.00134",
      "percentile": "0.03331"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39818\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-16T13:15:57.737\",\"lastModified\":\"2026-06-17T09:18:32.787\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nHID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save\\n\\nImproper use of secondary pointer (\u0026dev-\u003ei2c_subip_regs) caused\\nkernel crash and out-of-bounds error:\\n\\n BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510\\n Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107\\n\\n CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)\\n Workqueue: async async_run_entry_fn\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x76/0xa0\\n  print_report+0xd1/0x660\\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  ? kasan_complete_mode_report_info+0x26/0x200\\n  kasan_report+0xe1/0x120\\n  ? _regmap_bulk_read+0x449/0x510\\n  ? _regmap_bulk_read+0x449/0x510\\n  __asan_report_store4_noabort+0x17/0x30\\n  _regmap_bulk_read+0x449/0x510\\n  ? __pfx__regmap_bulk_read+0x10/0x10\\n  regmap_bulk_read+0x270/0x3d0\\n  pio_complete+0x1ee/0x2c0 [intel_thc]\\n  ? __pfx_pio_complete+0x10/0x10 [intel_thc]\\n  ? __pfx_pio_wait+0x10/0x10 [intel_thc]\\n  ? regmap_update_bits_base+0x13b/0x1f0\\n  thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]\\n  thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]\\n  ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]\\n[...]\\n The buggy address belongs to the object at ffff888136005d00\\n  which belongs to the cache kmalloc-rnd-12-192 of size 192\\n The buggy address is located 0 bytes to the right of\\n  allocated 192-byte region [ffff888136005d00, ffff888136005dc0)\\n\\nReplaced with direct array indexing (\u0026dev-\u003ei2c_subip_regs[i]) to ensure\\nsafe memory access.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4228966def884c6e34b85cdc7118c5d013e1718f\",\"lessThan\":\"78d4cf0466c79452e47aa6f720afbde63e709ccc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4228966def884c6e34b85cdc7118c5d013e1718f\",\"lessThan\":\"a7fc15ed629be89e51e09b743277c53e0a0168f5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.5\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T18:16:14.710756Z\",\"id\":\"CVE-2025-39818\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.16.5\",\"matchCriteriaId\":\"7B71908C-DDA9-4EA9-9BC6-2C7DFA7822C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/78d4cf0466c79452e47aa6f720afbde63e709ccc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7fc15ed629be89e51e09b743277c53e0a0168f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:20:45+00:00",
      "cve": "CVE-2025-39818",
      "id": "CVE-2025-39818",
      "initial_release_date": "2025-09-16T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_not_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39818.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:05:59Z",
      "cve": "CVE-2025-39818",
      "id": "CVE-2025-39818",
      "initial_release_date": "2025-09-16T23:24:00Z",
      "product_status:known_not_affected": "416",
      "product_status:recommended": "110",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39818",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39818.json",
      "version": "10"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39818\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T18:16:14.710756Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T18:16:09.449Z\"}}], \"cna\": {\"title\": \"HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4228966def884c6e34b85cdc7118c5d013e1718f\", \"lessThan\": \"78d4cf0466c79452e47aa6f720afbde63e709ccc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4228966def884c6e34b85cdc7118c5d013e1718f\", \"lessThan\": \"a7fc15ed629be89e51e09b743277c53e0a0168f5\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.16.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/78d4cf0466c79452e47aa6f720afbde63e709ccc\"}, {\"url\": \"https://git.kernel.org/stable/c/a7fc15ed629be89e51e09b743277c53e0a0168f5\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nHID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save\\n\\nImproper use of secondary pointer (\u0026dev-\u003ei2c_subip_regs) caused\\nkernel crash and out-of-bounds error:\\n\\n BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510\\n Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107\\n\\n CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)\\n Workqueue: async async_run_entry_fn\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x76/0xa0\\n  print_report+0xd1/0x660\\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  ? kasan_complete_mode_report_info+0x26/0x200\\n  kasan_report+0xe1/0x120\\n  ? _regmap_bulk_read+0x449/0x510\\n  ? _regmap_bulk_read+0x449/0x510\\n  __asan_report_store4_noabort+0x17/0x30\\n  _regmap_bulk_read+0x449/0x510\\n  ? __pfx__regmap_bulk_read+0x10/0x10\\n  regmap_bulk_read+0x270/0x3d0\\n  pio_complete+0x1ee/0x2c0 [intel_thc]\\n  ? __pfx_pio_complete+0x10/0x10 [intel_thc]\\n  ? __pfx_pio_wait+0x10/0x10 [intel_thc]\\n  ? regmap_update_bits_base+0x13b/0x1f0\\n  thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]\\n  thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]\\n  ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]\\n[...]\\n The buggy address belongs to the object at ffff888136005d00\\n  which belongs to the cache kmalloc-rnd-12-192 of size 192\\n The buggy address is located 0 bytes to the right of\\n  allocated 192-byte region [ffff888136005d00, ffff888136005dc0)\\n\\nReplaced with direct array indexing (\u0026dev-\u003ei2c_subip_regs[i]) to ensure\\nsafe memory access.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.5\", \"versionStartIncluding\": \"6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"6.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-07-30T05:57:49.442Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39818\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-30T05:57:49.442Z\", \"dateReserved\": \"2025-04-16T07:20:57.138Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-16T13:00:18.490Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.