Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save… (CVE-2025-39818)
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.
AI Analysis
Technical Summary
Red Hat issued a security update for the Linux kernel in Red Hat Enterprise Linux 9 to fix two vulnerabilities: CVE-2025-39818, which corrects improper pointer arithmetic in the intel-thc HID driver affecting I2C register saving, and CVE-2025-68800, which addresses a use-after-free vulnerability in the mlxsw spectrum_mr module related to multicast route statistics updates. These fixes are included in updated kernel packages that must be installed and the system rebooted to apply the changes. The advisory does not provide CVSS scores but classifies the severity as moderate.
Potential Impact
The vulnerabilities affect the Linux kernel core components in Red Hat Enterprise Linux 9 and related distributions. The pointer arithmetic flaw could lead to incorrect kernel behavior in the intel-thc HID driver, while the use-after-free vulnerability could cause memory corruption or instability when updating multicast route statistics. No known exploits in the wild have been reported. The issues could potentially impact system stability or security if exploited.
Mitigation Recommendations
Red Hat has released updated kernel packages that fix these vulnerabilities. Users should apply the kernel update as provided in Red Hat Security Advisory RHSA-2026:4759 and reboot their systems to ensure the fixes take effect. No additional mitigation steps are indicated beyond applying the official update and rebooting.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save… (CVE-2025-39818)
Description
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.
CVSS v3.1
Score 7.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat issued a security update for the Linux kernel in Red Hat Enterprise Linux 9 to fix two vulnerabilities: CVE-2025-39818, which corrects improper pointer arithmetic in the intel-thc HID driver affecting I2C register saving, and CVE-2025-68800, which addresses a use-after-free vulnerability in the mlxsw spectrum_mr module related to multicast route statistics updates. These fixes are included in updated kernel packages that must be installed and the system rebooted to apply the changes. The advisory does not provide CVSS scores but classifies the severity as moderate.
Potential Impact
The vulnerabilities affect the Linux kernel core components in Red Hat Enterprise Linux 9 and related distributions. The pointer arithmetic flaw could lead to incorrect kernel behavior in the intel-thc HID driver, while the use-after-free vulnerability could cause memory corruption or instability when updating multicast route statistics. No known exploits in the wild have been reported. The issues could potentially impact system stability or security if exploited.
Mitigation Recommendations
Red Hat has released updated kernel packages that fix these vulnerabilities. Users should apply the kernel update as provided in Red Hat Security Advisory RHSA-2026:4759 and reboot their systems to ensure the fixes take effect. No additional mitigation steps are indicated beyond applying the official update and rebooting.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:4759
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-68800"]
Threat ID: 6a32cf499f87a2db092a666b
Added to database: 06/17/2026, 16:46:01 UTC
Last enriched: 06/25/2026, 23:15:09 UTC
Last updated: 09/10/2026, 19:24:56 UTC
Views: 124
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.