Re: CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID

["gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>]

On Tue, Sep 30, 2025 at 10:42:31AM +0000, Siddh Raman Pant wrote:
> On Mon, 28 Jul 2025 13:22:37 +0200, Greg Kroah-Hartman wrote:
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > HID: core: ensure the allocated report buffer can contain the reserved report ID
> > 
> > When the report ID is not used, the low level transport drivers expect
> > the first byte to be 0. However, currently the allocated buffer not
> > account for that extra byte, meaning that instead of having 8 guaranteed
> > bytes for implement to be working, we only have 7.
> > 
> > The Linux kernel CVE team has assigned CVE-2025-38495 to this issue.
> 
> This commit prepares for the next commit in the patch series. See
> https://lore.kernel.org/all/20250710-report-size-null-v2-0-ccf922b7c4e5@kernel.org/
> 
> The patch series has 3 commits, with the main fix being the middle
> commit "HID: core: ensure __hid_request reserves the report ID as the
> first byte".
> 
> Unfortunately, the 1st and 3rd commit has CVE numbers assigned to them
> but not the actual fix.
> 
> Please assign CVE number to the middle commit.

What git id is that?

And this commit on its own fixes a problem, so it should be a separate
CVE, right?

> Segue: Can we not have same CVE number for a patch series fixing a
> vuln?

We can, but generally it's just one-fix-per-cve.

thanks,

greg k-h