In the Linux kernel, the following vulnerability has been resolved:
HID: core: Harden s32ton() against conversion to 0 bits
Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that.
Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does.
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/hid/hid-core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b504146c111548ab60b6ef7aad00bfb1db05a2",
"digest": {
"line_hashes": [
"232085607917776995571702870195088105548",
"288626439357710206068842473401099721045",
"243322362220642570599741090229206941166",
"195199993476652800565339862858152206753"
],
"threshold": 0.9
},
"id": "CVE-2025-38556-117d1584"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/hid/hid-core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@865ad8469fa24de1559f247d9426ab01e5ce3a56",
"digest": {
"line_hashes": [
"232085607917776995571702870195088105548",
"288626439357710206068842473401099721045",
"243322362220642570599741090229206941166",
"195199993476652800565339862858152206753"
],
"threshold": 0.9
},
"id": "CVE-2025-38556-18e4f2eb"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/hid/hid-core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd",
"digest": {
"line_hashes": [
"232085607917776995571702870195088105548",
"288626439357710206068842473401099721045",
"243322362220642570599741090229206941166",
"195199993476652800565339862858152206753"
],
"threshold": 0.9
},
"id": "CVE-2025-38556-39e92e45"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/hid/hid-core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4a94b1510f6a46ec48494b52ee8f67eb4fc836",
"digest": {
"line_hashes": [
"232085607917776995571702870195088105548",
"288626439357710206068842473401099721045",
"243322362220642570599741090229206941166",
"195199993476652800565339862858152206753"
],
"threshold": 0.9
},
"id": "CVE-2025-38556-3c0abe16"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/hid/hid-core.c",
"function": "s32ton"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@865ad8469fa24de1559f247d9426ab01e5ce3a56",
"digest": {
"length": 235.0,
"function_hash": "187877533464404024693464367746482657380"
},
"id": "CVE-2025-38556-66c41caf"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/hid/hid-core.c",
"function": "s32ton"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd",
"digest": {
"length": 235.0,
"function_hash": "187877533464404024693464367746482657380"
},
"id": "CVE-2025-38556-81692c90"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/hid/hid-core.c",
"function": "s32ton"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b504146c111548ab60b6ef7aad00bfb1db05a2",
"digest": {
"length": 235.0,
"function_hash": "187877533464404024693464367746482657380"
},
"id": "CVE-2025-38556-9a0274d0"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/hid/hid-core.c",
"function": "s32ton"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4a94b1510f6a46ec48494b52ee8f67eb4fc836",
"digest": {
"length": 235.0,
"function_hash": "187877533464404024693464367746482657380"
},
"id": "CVE-2025-38556-c37460cf"
}
]