Critical Vulnerability in Linux Kernel: Pool Report Handling Issue
Summary
CVE-2025-37942: In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX As noted by Anssi some 20 years ago, pool report is sometimes messed up. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. This vulnerability affects various Debian versions of the Linux package, specifically concerning the handling of pool reports in HID (Human Interface Device) drivers, which can lead to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the HID subsystem, specifically in the pidff driver. The issue arises when the pool report is not correctly fetched before accessing its fields, leading to potential system crashes (oops) on certain devices, such as the VRS DirectForce PRO. This flaw can cause infinite loops or system hangs, impacting the overall stability and reliability of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-37942 vulnerability in the Linux kernel poses significant risks to system stability due to improper handling of pool reports. Users are encouraged to update their systems to the latest patched versions to ensure protection against potential crashes and system instability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37942 is a vulnerability in the Linux kernel's HID subsystem that can lead to system crashes due to improper handling of pool reports.
The vulnerability affects Debian versions 11, 12, and 13 of the Linux package.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, a patch is available for Debian 13 in version 6.12.25-1. Users of Debian 11 and 12 should look out for updates.
While no specific workaround is available, it is crucial to monitor for updates and apply them as soon as they are released to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
