HID Sensor Interface Vulnerability in Linux Package: Chicony Electronics HP 5MP Cameras
Summary
CVE-2025-38540: In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID senso... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential functionalities such as process management, memory management, and device control. The kernel supports a wide range of hardware devices, including USB peripherals. The vulnerability in question affects the HID (Human Interface Device) subsystem, specifically related to certain Chicony Electronics HP 5MP Cameras that report a non-functional sensor interface.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where two models of Chicony Electronics HP 5MP Cameras (USB IDs 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not implemented. Accessing this non-functional sensor can lead to system hangs as the runtime power management attempts to wake up an unresponsive sensor. This issue arises from the design flaw where the sensor interface should not be exposed to userspace, leading to potential denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can add the affected devices to the HID ignore list to prevent the system from attempting to access the non-functional sensor interface. This can be done by modifying the kernel parameters or configuration files to exclude these USB IDs.
Conclusion
The vulnerability in the Linux kernel related to the Chicony Electronics HP 5MP Cameras poses a risk of system hangs due to the exposure of a non-functional sensor interface. Users are advised to update their systems to the latest patched versions to mitigate this risk. Workarounds are available for those unable to update immediately.
See every vulnerability recorded for linux →
FAQ
The vulnerability can cause system hangs when attempting to access the non-functional sensor interface of the affected cameras.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The affected cameras have the USB IDs 04F2:B824 and 04F2:B82C.
Yes, updating to the patched versions of the Linux package will resolve the vulnerability.
If immediate updates are not possible, consider applying the workaround by adding the affected devices to the HID ignore list.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
