Stack-Out-of-Bounds Read Vulnerability in Linux Kernel HID Thrustmaster Driver
Summary
CVE-2025-21794: In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints() Syzbot[1] has detected a stack-out-of-bounds read of the ep_addr array... Affects linux versions < 6.1.129-1. Fixed in 6.1.129-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The HID (Human Interface Device) subsystem allows the operating system to communicate with input devices like keyboards and game controllers. The Thrustmaster driver is specifically designed for Thrustmaster gaming peripherals. This driver, while facilitating user interaction with gaming devices, has been found to have a vulnerability that can lead to system crashes.
Vulnerability Detail
In the Linux kernel, a stack-out-of-bounds read vulnerability was identified in the hid-thrustmaster driver. This issue arises from the ep_addr array being passed to the usb_check_int_endpoints function, which iterates over the elements of the array. When the function does not encounter a null element at the end of the array, it attempts to read beyond the allocated memory, leading to a kernel crash. This vulnerability was detected by Syzbot, a tool for finding bugs in the Linux kernel.
How To Fix
Minimum fixed version
6.1.129-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel as described in the 'how_to_fix' section.
Conclusion
The stack-out-of-bounds read vulnerability in the Linux kernel's HID Thrustmaster driver poses a risk of kernel crashes. Users are advised to update their kernel packages to the latest version to mitigate this issue. Monitoring tools like Vulert can assist in identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
A stack-out-of-bounds read vulnerability occurs when a program reads data outside the bounds of allocated memory, potentially leading to crashes or unintended behavior.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities. By simply using a manifest file like package-lock.json, you can check if your application is affected without requiring code access.
The primary consequence of this vulnerability is a kernel crash, which can lead to system instability and loss of unsaved data.
Yes, the vulnerability affects the Linux kernel versions prior to the patch being applied. Users should ensure they are running the latest version to avoid this issue.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
