Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious… (CVE-2025-39806)
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] <TASK> [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...]
AI Analysis
Technical Summary
This Red Hat security advisory addresses several vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 10.0 Extended Update Support. The fixes cover a conditional IBPB mitigation for x86/vmscape (CVE-2025-40300), a slab out-of-bounds access in the HID multitouch driver (CVE-2025-39806), avoidance of unnecessary wake-ups in memory management (CVE-2025-39843), a fix for a VM_BUG_ON_PAGE error when unpoisoning memory (CVE-2025-39883), implementation of a NETDEV_UNREGISTER notification handler in the CAN j1939 subsystem (CVE-2025-39925), and multiple use-after-free vulnerabilities in Bluetooth components (CVE-2025-39981, CVE-2025-39982, CVE-2025-39983). The advisory references Red Hat's errata RHSA-2026:0271 for detailed patch information and requires rebooting affected systems after applying updates.
Potential Impact
The vulnerabilities affect core kernel components and could lead to memory corruption issues such as out-of-bounds access and use-after-free conditions. These issues may cause system instability, crashes, or potentially allow escalation of privileges or other security impacts depending on exploitation. The advisory rates the overall security impact as Moderate, but the presence of use-after-free and memory corruption bugs typically warrants a high severity classification.
Mitigation Recommendations
Red Hat has released updated kernel packages addressing these vulnerabilities. Users should apply the security update for Red Hat Enterprise Linux 10.0 Extended Update Support as detailed in Red Hat advisory RHSA-2026:0271. A system reboot is required for the update to take effect. No additional mitigations are specified beyond applying the official patches.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious… (CVE-2025-39806)
Description
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] <TASK> [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...]
CVSS v3.1
Score 8.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory addresses several vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 10.0 Extended Update Support. The fixes cover a conditional IBPB mitigation for x86/vmscape (CVE-2025-40300), a slab out-of-bounds access in the HID multitouch driver (CVE-2025-39806), avoidance of unnecessary wake-ups in memory management (CVE-2025-39843), a fix for a VM_BUG_ON_PAGE error when unpoisoning memory (CVE-2025-39883), implementation of a NETDEV_UNREGISTER notification handler in the CAN j1939 subsystem (CVE-2025-39925), and multiple use-after-free vulnerabilities in Bluetooth components (CVE-2025-39981, CVE-2025-39982, CVE-2025-39983). The advisory references Red Hat's errata RHSA-2026:0271 for detailed patch information and requires rebooting affected systems after applying updates.
Potential Impact
The vulnerabilities affect core kernel components and could lead to memory corruption issues such as out-of-bounds access and use-after-free conditions. These issues may cause system instability, crashes, or potentially allow escalation of privileges or other security impacts depending on exploitation. The advisory rates the overall security impact as Moderate, but the presence of use-after-free and memory corruption bugs typically warrants a high severity classification.
Mitigation Recommendations
Red Hat has released updated kernel packages addressing these vulnerabilities. Users should apply the security update for Red Hat Enterprise Linux 10.0 Extended Update Support as detailed in Red Hat advisory RHSA-2026:0271. A system reboot is required for the update to take effect. No additional mitigations are specified beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:0271
- Cve Count
- 8
- Additional Cves
- ["CVE-2025-39843","CVE-2025-39883","CVE-2025-39925","CVE-2025-39981","CVE-2025-39982","CVE-2025-39983","CVE-2025-40300"]
Threat ID: 6a19fee3e29bf47b500feadd
Added to database: 05/29/2026, 21:02:27 UTC
Last enriched: 06/26/2026, 01:21:21 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 137
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.