Skip to main content
VulnerabilityPublished Updated

CVE-2025-39808: Linux kernel · HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in e422370e6ab28478872b914cee5d49a9bdfae0c6 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 21:35 UTC

Severity
Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none
CISA SSVC
Exploitation
No evidence of active exploitation and no public proof of concept
Automatable
Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact
Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch
Available – fixed in e422370e6ab28478872b914cee5d49a9bdfae0c6, 6070123d5344d0950f10ef6a5fdc3f076abb7ad2, 98520a9a3d69a530dd1ee280cbe0abc232a35bff +5

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 16 Sep 2025

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ 0277873c05158c5efc97c23d52e6aec6250bde0f, < e422370e6ab28478872b914cee5d49a9bdfae0c6
Fixed in
  • e422370e6ab28478872b914cee5d49a9bdfae0c6
LinuxLinuxAffected
  • ≥ 0277873c05158c5efc97c23d52e6aec6250bde0f, < 6070123d5344d0950f10ef6a5fdc3f076abb7ad2
Fixed in
  • 6070123d5344d0950f10ef6a5fdc3f076abb7ad2
LinuxLinuxAffected
  • ≥ 0277873c05158c5efc97c23d52e6aec6250bde0f, < 98520a9a3d69a530dd1ee280cbe0abc232a35bff
Fixed in
  • 98520a9a3d69a530dd1ee280cbe0abc232a35bff
LinuxLinuxAffected
  • ≥ 0277873c05158c5efc97c23d52e6aec6250bde0f, < 4338b0f6544c3ff042bfbaf40bc9afe531fb08c7
Fixed in
  • 4338b0f6544c3ff042bfbaf40bc9afe531fb08c7
LinuxLinuxAffected
  • ≥ 0277873c05158c5efc97c23d52e6aec6250bde0f, < 185c926283da67a72df20a63a5046b3b4631b7d9
Fixed in
  • 185c926283da67a72df20a63a5046b3b4631b7d9
LinuxLinuxAffected
  • ≥ 0277873c05158c5efc97c23d52e6aec6250bde0f, < 183def8e4d786e50165e5d992df6a3083e45e16c
Fixed in
  • 183def8e4d786e50165e5d992df6a3083e45e16c

AI-suggested

A fix is available and has been applied in multiple Linux kernel commits. Users should update their Linux kernel to a version including these fixes to remediate the vulnerability.

Description

A vulnerability in the Linux kernel's HID subsystem (hid-ntrig driver) could cause a page fault due to a null pointer dereference in the ntrig_report_version() function. This occurs when the hdev parameter's device parent hierarchy is unexpectedly null, leading to an invalid USB device address and triggering a page fault. The issue has been fixed by adding a null check before calling hid_to_usb_dev().

References

Community reviews

Loading reviews…