{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-37942", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.971Z", "datePublished": "2025-05-20T15:58:18.935Z", "dateUpdated": "2025-05-26T05:24:12.771Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-26T05:24:12.771Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX\n\nAs noted by Anssi some 20 years ago, pool report is sometimes messed up.\nThis worked fine on many devices but casued oops on VRS DirectForce PRO.\n\nHere, we're making sure pool report is refetched before trying to access\nany of it's fields. While loop was replaced with a for loop + exit\nconditions were moved aroud to decrease the possibility of creating an\ninfinite loop scenario."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/usbhid/hid-pidff.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "211861869766a7bb7c72158aee0140ec67e182a7", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "344d903be8b5c0733ed0f4bc5be34b4a26d905c8", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "a6f5d30a5c7713238c5c65c98ad95dacb73688d5", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "1f650dcec32d22deb1d6db12300a2b98483099a9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/usbhid/hid-pidff.c"], "versions": [{"version": "6.12.24", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.12", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.3", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.13.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.14.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/211861869766a7bb7c72158aee0140ec67e182a7"}, {"url": "https://git.kernel.org/stable/c/344d903be8b5c0733ed0f4bc5be34b4a26d905c8"}, {"url": "https://git.kernel.org/stable/c/a6f5d30a5c7713238c5c65c98ad95dacb73688d5"}, {"url": "https://git.kernel.org/stable/c/1f650dcec32d22deb1d6db12300a2b98483099a9"}], "title": "HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX\n\nAs noted by Anssi some 20 years ago, pool report is sometimes messed up.\nThis worked fine on many devices but casued oops on VRS DirectForce PRO.\n\nHere, we're making sure pool report is refetched before trying to access\nany of it's fields. While loop was replaced with a for loop + exit\nconditions were moved aroud to decrease the possibility of creating an\ninfinite loop scenario."}], "id": "CVE-2025-37942", "lastModified": "2025-05-21T20:24:58.133", "metrics": {}, "published": "2025-05-20T16:15:32.000", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1f650dcec32d22deb1d6db12300a2b98483099a9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/211861869766a7bb7c72158aee0140ec67e182a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/344d903be8b5c0733ed0f4bc5be34b4a26d905c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a6f5d30a5c7713238c5c65c98ad95dacb73688d5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX", "id": "2368520", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368520"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nHID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX\nAs noted by Anssi some 20 years ago, pool report is sometimes messed up.\nThis worked fine on many devices but casued oops on VRS DirectForce PRO.\nHere, we're making sure pool report is refetched before trying to access\nany of it's fields. While loop was replaced with a for loop + exit\nconditions were moved aroud to decrease the possibility of creating an\ninfinite loop scenario."], "name": "CVE-2025-37942", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37942\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37942\nhttps://lore.kernel.org/linux-cve-announce/2025052043-CVE-2025-37942-fbca@gregkh/T"], "statement": "Improper fetching of the \"pool\" report in the PIDFF (Force Feedback) HID driver could cause dereferencing of uninitialized pointers on devices with broken descriptors (e.g., VRS DirectForce PRO). Only leads to potential kernel oops. Privileges Required: Local access with permissions to connect specific USB HID devices.", "threat_severity": "Low"}