CVE-2025-39818 (GCVE-0-2025-39818)

Vulnerability from cvelistv5 – Published: 2025-09-16 13:00 – Updated: 2026-08-05 12:05
VLAI
Title
HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 18:16 UTC
CWE
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7018 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4228966def884c6e34b85cdc7118c5d013e1718f , < 78d4cf0466c79452e47aa6f720afbde63e709ccc (git)
Affected: 4228966def884c6e34b85cdc7118c5d013e1718f , < a7fc15ed629be89e51e09b743277c53e0a0168f5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.16.5 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:16:14.710756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:22:55.882Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78d4cf0466c79452e47aa6f720afbde63e709ccc",
              "status": "affected",
              "version": "4228966def884c6e34b85cdc7118c5d013e1718f",
              "versionType": "git"
            },
            {
              "lessThan": "a7fc15ed629be89e51e09b743277c53e0a0168f5",
              "status": "affected",
              "version": "4228966def884c6e34b85cdc7118c5d013e1718f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.5",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save\n\nImproper use of secondary pointer (\u0026dev-\u003ei2c_subip_regs) caused\nkernel crash and out-of-bounds error:\n\n BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510\n Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107\n\n CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)\n Workqueue: async async_run_entry_fn\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x76/0xa0\n  print_report+0xd1/0x660\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? kasan_complete_mode_report_info+0x26/0x200\n  kasan_report+0xe1/0x120\n  ? _regmap_bulk_read+0x449/0x510\n  ? _regmap_bulk_read+0x449/0x510\n  __asan_report_store4_noabort+0x17/0x30\n  _regmap_bulk_read+0x449/0x510\n  ? __pfx__regmap_bulk_read+0x10/0x10\n  regmap_bulk_read+0x270/0x3d0\n  pio_complete+0x1ee/0x2c0 [intel_thc]\n  ? __pfx_pio_complete+0x10/0x10 [intel_thc]\n  ? __pfx_pio_wait+0x10/0x10 [intel_thc]\n  ? regmap_update_bits_base+0x13b/0x1f0\n  thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]\n  thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]\n  ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]\n[...]\n The buggy address belongs to the object at ffff888136005d00\n  which belongs to the cache kmalloc-rnd-12-192 of size 192\n The buggy address is located 0 bytes to the right of\n  allocated 192-byte region [ffff888136005d00, ffff888136005dc0)\n\nReplaced with direct array indexing (\u0026dev-\u003ei2c_subip_regs[i]) to ensure\nsafe memory access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is in a PCI HID driver\u0027s system-suspend callback, reachable only from the local machine by triggering a suspend (logind/systemctl suspend, lid close, or idle timeout). There is no network or remote-peer input path to `thc_i2c_subip_regs_save()`.\nAC:L - The bad pointer arithmetic is unconditional \u2014 every single suspend on affected Intel THC I2C hardware writes 60 bytes at the wrong address, ~40 of them past the end of the slab object, with no race or timing dependency. Heap grooming to place a chosen victim object in the adjacent kmalloc-192 slot is standard and under attacker control.\nPR:L - An unprivileged local user with an active session can initiate system suspend via systemd-logind, which default polkit policy grants to active local sessions without root. No CAP_SYS_ADMIN or `/sys/power/state` write access is needed, and the path is additionally reached by automatic idle suspend.\nUI:N - The attacker triggers the suspend themselves; no separate victim needs to take any action. The bug also fires on unattended idle or lid-close suspend with no user involvement at all.\nS:U - The out-of-bounds write corrupts kernel slab memory within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The restore path performs a matching ~40-byte out-of-bounds read of the adjacent heap object and pushes it into hardware registers, and the OOB write can corrupt a groomed neighbouring object\u0027s length or pointer fields to yield an arbitrary-read primitive. Per kernel guidance, unbounded OOB access and memory corruption leverageable for disclosure score High.\nI:H - This is a slab out-of-bounds write of roughly 40 bytes past the allocation into an adjacent heap object, which also silently corrupts `struct thc_device`\u0027s own tail fields including the `i2c_subip_regs` pointer. Out-of-bounds heap writes are scored High because heap grooming can direct the corruption at security-relevant fields.\nA:H - The commit message and KASAN trace explicitly document a kernel crash from this out-of-bounds write, and it recurs on every suspend cycle. Corruption of the adjacent slab object plus programming garbage into live I2C controller registers on resume also renders the touch input device inoperable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:24.894Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78d4cf0466c79452e47aa6f720afbde63e709ccc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7fc15ed629be89e51e09b743277c53e0a0168f5"
        }
      ],
      "title": "HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39818",
    "datePublished": "2025-09-16T13:00:18.490Z",
    "dateReserved": "2025-04-16T07:20:57.138Z",
    "dateUpdated": "2026-08-05T12:05:24.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39818",
      "date": "2026-11-01",
      "epss": "0.00147",
      "percentile": "0.03938"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "78d4cf0466c79452e47aa6f720afbde63e709ccc",
                    "status": "affected",
                    "version": "4228966def884c6e34b85cdc7118c5d013e1718f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a7fc15ed629be89e51e09b743277c53e0a0168f5",
                    "status": "affected",
                    "version": "4228966def884c6e34b85cdc7118c5d013e1718f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7B71908C-DDA9-4EA9-9BC6-2C7DFA7822C8",
                    "versionEndExcluding": "6.16.5",
                    "versionStartIncluding": "6.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save\n\nImproper use of secondary pointer (\u0026dev-\u003ei2c_subip_regs) caused\nkernel crash and out-of-bounds error:\n\n BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510\n Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107\n\n CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)\n Workqueue: async async_run_entry_fn\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x76/0xa0\n  print_report+0xd1/0x660\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? kasan_complete_mode_report_info+0x26/0x200\n  kasan_report+0xe1/0x120\n  ? _regmap_bulk_read+0x449/0x510\n  ? _regmap_bulk_read+0x449/0x510\n  __asan_report_store4_noabort+0x17/0x30\n  _regmap_bulk_read+0x449/0x510\n  ? __pfx__regmap_bulk_read+0x10/0x10\n  regmap_bulk_read+0x270/0x3d0\n  pio_complete+0x1ee/0x2c0 [intel_thc]\n  ? __pfx_pio_complete+0x10/0x10 [intel_thc]\n  ? __pfx_pio_wait+0x10/0x10 [intel_thc]\n  ? regmap_update_bits_base+0x13b/0x1f0\n  thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]\n  thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]\n  ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]\n[...]\n The buggy address belongs to the object at ffff888136005d00\n  which belongs to the cache kmalloc-rnd-12-192 of size 192\n The buggy address is located 0 bytes to the right of\n  allocated 192-byte region [ffff888136005d00, ffff888136005dc0)\n\nReplaced with direct array indexing (\u0026dev-\u003ei2c_subip_regs[i]) to ensure\nsafe memory access."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nHID: intel-thc-hid: intel-thc: Correcci\u00f3n de aritm\u00e9tica de punteros incorrecta en el guardado de registros I2C\n\nEl uso indebido del puntero secundario (\u0026dev-\u003ei2c_subip_regs) caus\u00f3 un fallo del kernel y un error de fuera de l\u00edmites:\n\n BUG: KASAN: slab-fuera-de-l\u00edmites en _regmap_bulk_read+0x449/0x510\n Escritura de tama\u00f1o 4 en la direcci\u00f3n ffff888136005dc0 por la tarea kworker/u33:5/5107\n\n CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 No contaminado 6.16.0+ #3 PREEMPT(voluntario)\n Cola de trabajo: async async_run_entry_fn\n Rastreo de llamadas:\n  \u003cTAREA\u003e\n  dump_stack_lvl+0x76/0xa0\n  print_report+0xd1/0x660\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? kasan_complete_mode_report_info+0x26/0x200\n  kasan_report+0xe1/0x120\n  ? _regmap_bulk_read+0x449/0x510\n  ? _regmap_bulk_read+0x449/0x510\n  __asan_report_store4_noabort+0x17/0x30\n  _regmap_bulk_read+0x449/0x510\n  ? __pfx__regmap_bulk_read+0x10/0x10\n  regmap_bulk_read+0x270/0x3d0\n  pio_complete+0x1ee/0x2c0 [intel_thc]\n  ? __pfx_pio_complete+0x10/0x10 [intel_thc]\n  ? __pfx_pio_wait+0x10/0x10 [intel_thc]\n  ? regmap_update_bits_base+0x13b/0x1f0\n  thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]\n  thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]\n  ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]\n[...]\n La direcci\u00f3n err\u00f3nea pertenece al objeto en ffff888136005d00\n  que pertenece a la cach\u00e9 kmalloc-rnd-12-192 de tama\u00f1o 192\n La direcci\u00f3n err\u00f3nea est\u00e1 ubicada 0 bytes a la derecha de\n  la regi\u00f3n asignada de 192 bytes [ffff888136005d00, ffff888136005dc0)\n\nReemplazado con indexaci\u00f3n directa de array (\u0026dev-\u003ei2c_subip_regs[i]) para asegurar un acceso seguro a la memoria."
          }
        ],
        "id": "CVE-2025-39818",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-39818",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:16:14.710756Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-16T13:15:57.737",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/78d4cf0466c79452e47aa6f720afbde63e709ccc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a7fc15ed629be89e51e09b743277c53e0a0168f5"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-30T03:15:02+00:00",
      "cve": "CVE-2025-39818",
      "id": "CVE-2025-39818",
      "initial_release_date": "2025-09-16T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_not_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39818.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-39818",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-14T18:16:14.710756Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-787",
                    "description": "CWE-787 Out-of-bounds Write",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-14T18:16:09.449Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "78d4cf0466c79452e47aa6f720afbde63e709ccc",
                  "status": "affected",
                  "version": "4228966def884c6e34b85cdc7118c5d013e1718f",
                  "versionType": "git"
                },
                {
                  "lessThan": "a7fc15ed629be89e51e09b743277c53e0a0168f5",
                  "status": "affected",
                  "version": "4228966def884c6e34b85cdc7118c5d013e1718f",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.14"
                },
                {
                  "lessThan": "6.14",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.16.*",
                  "status": "unaffected",
                  "version": "6.16.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.17",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.16.5",
                      "versionStartIncluding": "6.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.17",
                      "versionStartIncluding": "6.14",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save\n\nImproper use of secondary pointer (\u0026dev-\u003ei2c_subip_regs) caused\nkernel crash and out-of-bounds error:\n\n BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510\n Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107\n\n CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)\n Workqueue: async async_run_entry_fn\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x76/0xa0\n  print_report+0xd1/0x660\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? kasan_complete_mode_report_info+0x26/0x200\n  kasan_report+0xe1/0x120\n  ? _regmap_bulk_read+0x449/0x510\n  ? _regmap_bulk_read+0x449/0x510\n  __asan_report_store4_noabort+0x17/0x30\n  _regmap_bulk_read+0x449/0x510\n  ? __pfx__regmap_bulk_read+0x10/0x10\n  regmap_bulk_read+0x270/0x3d0\n  pio_complete+0x1ee/0x2c0 [intel_thc]\n  ? __pfx_pio_complete+0x10/0x10 [intel_thc]\n  ? __pfx_pio_wait+0x10/0x10 [intel_thc]\n  ? regmap_update_bits_base+0x13b/0x1f0\n  thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]\n  thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]\n  ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]\n[...]\n The buggy address belongs to the object at ffff888136005d00\n  which belongs to the cache kmalloc-rnd-12-192 of size 192\n The buggy address is located 0 bytes to the right of\n  allocated 192-byte region [ffff888136005d00, ffff888136005dc0)\n\nReplaced with direct array indexing (\u0026dev-\u003ei2c_subip_regs[i]) to ensure\nsafe memory access."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-30T05:57:49.442Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/78d4cf0466c79452e47aa6f720afbde63e709ccc"
            },
            {
              "url": "https://git.kernel.org/stable/c/a7fc15ed629be89e51e09b743277c53e0a0168f5"
            }
          ],
          "title": "HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-39818",
        "datePublished": "2025-09-16T13:00:18.490Z",
        "dateReserved": "2025-04-16T07:20:57.138Z",
        "dateUpdated": "2026-07-30T05:57:49.442Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.