CVE-2025-38103

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()<br /> <br /> Update struct hid_descriptor to better reflect the mandatory and<br /> optional parts of the HID Descriptor as per USB HID 1.11 specification.<br /> Note: the kernel currently does not parse any optional HID class<br /> descriptors, only the mandatory report descriptor.<br /> <br /> Update all references to member element desc[0] to rpt_desc.<br /> <br /> Add test to verify bLength and bNumDescriptors values are valid.<br /> <br /> Replace the for loop with direct access to the mandatory HID class<br /> descriptor member for the report descriptor. This eliminates the<br /> possibility of getting an out-of-bounds fault.<br /> <br /> Add a warning message if the HID descriptor contains any unsupported<br /> optional HID class descriptors.