{"id":"CVE-2025-38556","state":"PUBLISHED","title":"HID: core: Harden s32ton() against conversion to 0 bits","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Harden s32ton() against conversion to 0 bits\n\nTesting by the syzbot fuzzer showed that the HID core gets a\nshift-out-of-bounds exception when it tries to convert a 32-bit\nquantity to a 0-bit quantity.  Ideally this should never occur, but\nthere are buggy devices and some might have a report field with size\nset to zero; we shouldn't reject the report or the device just because\nof that.\n\nInstead, harden the s32ton() routine so that it returns a reasonable\nresult instead of crashing when it is called with the number of bits\nset to 0 -- the same as what snto32() does.","publishedAt":"2025-08-19T17:02:34.929Z","updatedAt":"2026-06-11T18:44:17.332Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"6cdf6c708717c5c6897d0800a1793e83757c7491","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"eeeaba737919bdce9885e2a00ac2912f61a3684d","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"3c86548a20d7bc2861aa4de044991a327bebad1a","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"810189546cb6c8f36443ed091d91f1f5d2fc2ec7","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"d3b504146c111548ab60b6ef7aad00bfb1db05a2","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"8b4a94b1510f6a46ec48494b52ee8f67eb4fc836","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"865ad8469fa24de1559f247d9426ab01e5ce3a56","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hid/hid-core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.20","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.20","versionType":"semver"},{"version":"5.10.248","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.198","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.159","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.119","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.46","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.10","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16.1","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hid/hid-core.c"]}],"references":["https://git.kernel.org/stable/c/6cdf6c708717c5c6897d0800a1793e83757c7491","https://git.kernel.org/stable/c/eeeaba737919bdce9885e2a00ac2912f61a3684d","https://git.kernel.org/stable/c/3c86548a20d7bc2861aa4de044991a327bebad1a","https://git.kernel.org/stable/c/810189546cb6c8f36443ed091d91f1f5d2fc2ec7","https://git.kernel.org/stable/c/d3b504146c111548ab60b6ef7aad00bfb1db05a2","https://git.kernel.org/stable/c/8b4a94b1510f6a46ec48494b52ee8f67eb4fc836","https://git.kernel.org/stable/c/865ad8469fa24de1559f247d9426ab01e5ce3a56","https://git.kernel.org/stable/c/a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38556.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38556","state":"PUBLISHED","datePublished":"2025-08-19T17:02:34.929Z","dateUpdated":"2026-06-11T18:44:17.332Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:24.025Z"},"containers":{"cna":{"title":"HID: core: Harden s32ton() against conversion to 0 bits","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Harden s32ton() against conversion to 0 bits\n\nTesting by the syzbot fuzzer showed that the HID core gets a\nshift-out-of-bounds exception when it tries to convert a 32-bit\nquantity to a 0-bit quantity.  Ideally this should never occur, but\nthere are buggy devices and some might have a report field with size\nset to zero; we shouldn't reject the report or the device just because\nof that.\n\nInstead, harden the s32ton() routine so that it returns a reasonable\nresult instead of crashing when it is called with the number of bits\nset to 0 -- the same as what snto32() does."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"6cdf6c708717c5c6897d0800a1793e83757c7491","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"eeeaba737919bdce9885e2a00ac2912f61a3684d","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"3c86548a20d7bc2861aa4de044991a327bebad1a","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"810189546cb6c8f36443ed091d91f1f5d2fc2ec7","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"d3b504146c111548ab60b6ef7aad00bfb1db05a2","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"8b4a94b1510f6a46ec48494b52ee8f67eb4fc836","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"865ad8469fa24de1559f247d9426ab01e5ce3a56","versionType":"git"},{"version":"dde5845a529ff753364a6d1aea61180946270bfa","status":"affected","lessThan":"a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hid/hid-core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.20","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.20","versionType":"semver"},{"version":"5.10.248","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.198","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.159","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.119","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.46","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.10","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16.1","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hid/hid-core.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6cdf6c708717c5c6897d0800a1793e83757c7491"},{"url":"https://git.kernel.org/stable/c/eeeaba737919bdce9885e2a00ac2912f61a3684d"},{"url":"https://git.kernel.org/stable/c/3c86548a20d7bc2861aa4de044991a327bebad1a"},{"url":"https://git.kernel.org/stable/c/810189546cb6c8f36443ed091d91f1f5d2fc2ec7"},{"url":"https://git.kernel.org/stable/c/d3b504146c111548ab60b6ef7aad00bfb1db05a2"},{"url":"https://git.kernel.org/stable/c/8b4a94b1510f6a46ec48494b52ee8f67eb4fc836"},{"url":"https://git.kernel.org/stable/c/865ad8469fa24de1559f247d9426ab01e5ce3a56"},{"url":"https://git.kernel.org/stable/c/a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:30:22.814Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.20","versionEndExcluding":"5.10.248"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.20","versionEndExcluding":"5.15.198"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.20","versionEndExcluding":"6.1.159"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.20","versionEndExcluding":"6.6.119"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.20","versionEndExcluding":"6.12.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.20","versionEndExcluding":"6.15.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.20","versionEndExcluding":"6.16.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.20","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-38556","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-06-10T20:41:53.944834Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-11T18:44:17.332Z"}}]}}}