Critical HID BPF Vulnerability in Linux Package: Device Unplugging Leads to Memory Access Issues
Summary
DEBIAN-CVE-2025-38016: In the Linux kernel, the following vulnerability has been resolved: HID: bpf: abort dispatch if device destroyed The current HID bpf implementation assumes no output report/request will go through it after hid_bpf_destro... Affects linux versions < 6.12.30-1. Fixed in 6.12.30-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It includes drivers for various devices, including Human Interface Devices (HID) such as keyboards and mice. This vulnerability specifically affects the HID BPF (Berkeley Packet Filter) implementation, which is responsible for handling input and output reports for HID devices. The flaw arises when certain HID devices are unplugged, leading to potential memory access violations.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the HID BPF implementation that assumes no output report or request will be processed after the destruction of a HID device. This can lead to accessing cleaned-up memory structures, causing crashes or undefined behavior. The issue is triggered when a device with LEDs is unplugged while the driver does not implement the required request handling. This bug has been present since the introduction of the dispatch_hid_bpf_output_report function, and it poses risks of memory corruption and system instability.
How To Fix
Minimum fixed version
6.12.30-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid unplugging HID devices that have LEDs while the system is running, especially if the driver does not implement the required output request handling. This can help prevent triggering the vulnerability until a proper update is applied.
Conclusion
The HID BPF vulnerability in the Linux package poses significant risks related to memory access violations when certain devices are unplugged. Users are strongly encouraged to update their systems to the patched version to mitigate these risks. Temporary workarounds are available, but the best course of action is to apply the update as soon as possible.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows for potential memory access violations when certain HID devices are unplugged, leading to system instability.
The vulnerability affects all versions prior to 6.12.30-1 in both Debian 13 and Debian 14.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
As a workaround, avoid unplugging HID devices with LEDs until you can apply the necessary updates.
While the primary risk is system instability, it is advisable to back up important data as a precaution when dealing with vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
