In the Linux kernel, the following vulnerability has been resolved:
HID: core: Harden s32ton() against conversion to 0 bits
Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that.
Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38556.json",
"cna_assigner": "Linux"
}[
{
"target": {
"file": "drivers/hid/hid-core.c"
},
"id": "CVE-2025-38556-3c0abe16",
"digest": {
"line_hashes": [
"232085607917776995571702870195088105548",
"288626439357710206068842473401099721045",
"243322362220642570599741090229206941166",
"195199993476652800565339862858152206753"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4a94b1510f6a46ec48494b52ee8f67eb4fc836",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"function": "s32ton",
"file": "drivers/hid/hid-core.c"
},
"id": "CVE-2025-38556-c37460cf",
"digest": {
"function_hash": "187877533464404024693464367746482657380",
"length": 235.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4a94b1510f6a46ec48494b52ee8f67eb4fc836",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38556.json"