PT-2026-37591

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Fake USB devices can send report descriptors that bypass the input mapping hook. This causes the pm-input ep82 variable to remain NULL, which can lead to a system crash. This issue is...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000484)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000484 advisory. A flaw was found in the Linux kernel in the function hiddebugeventsread in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters pass...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000316)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000316 advisory. In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka...

PT-2026-21913

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.4.0 through 4.4.13 Wireshark versions 4.6.0 through 4.6.3 Description The USB HID protocol dissector in Wireshark is susceptible to memory exhaustion, potentially leading to a denial of service. The issue occurs when...

PT-2026-27747

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw where raw event callbacks could occur even for a HID device that had not been claimed, potentially causing a crash if a broken device were connected. The...

AZL-78377 CVE-2023-54207 affecting package kernel for versions less than 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Correct devm device reference for hidinput inputdev name Reference the HID device rather than the input device for the devm allocation of the inputdev name. Referencing the inputdev would lead to a use-after-free wh...

CVE-2023-54207

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Correct devm device reference for hidinput inputdev name Reference the HID device rather than the input device for the devm allocation of the inputdev name. Referencing the inputdev would lead to a use-after-free wh...

CVE-2023-54207

CVE-2023-54207 affects the Linux kernel HID: uclogic driver. The root cause is using the input_dev name’s devm allocation instead of referencing the HID device, which could lead to a use-after-free when the input_dev is unregistered and a uevent depending on its name fires. The fix switches to re...

CVE-2023-54207

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Correct devm device reference for hidinput inputdev name Reference the HID device rather than the input device for the devm allocation of the inputdev name. Referencing the inputdev would lead to a use-after-free wh...

CVE-2025-43533

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash...

CVE-2025-43533

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash...

CVE-2025-43533

Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in watchOS 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, tvOS 26.2. A malicious HID device may cause an unexpected process crash...

CVE-2025-43533

CVE-2025-43533 concerns a vulnerability in Apple’s Multi-Touch handling where a malicious HID device could trigger an unexpected process crash. The issue stems from insufficient bounds checking, with fixes described as improved bounds checks and memory handling. Affected products include iOS/iPad...

CVE-2025-63896

An issue in the Bluetooth Human Interface Device HID of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device...

CVE-2023-53797 HID: wacom: Use ktime_t rather than int when dealing with timestamps

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Use ktimet rather than int when dealing with timestamps Code which interacts with timestamps needs to use the ktimet type returned by functions like ktimeget. The int type does not offer enough space to store these...

CVE-2025-63896

An issue in the Bluetooth Human Interface Device HID of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device...

kernel: HID: core: Harden s32ton() against conversion to 0 bits

In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should...

CVE-2025-63896

An issue in the Bluetooth Human Interface Device HID of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device...

USN-7879-3: Linux kernel vulnerabilities

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. CVE-2024-36331 Several security issues were discovered in the Linux kernel. An attacker could possibly use...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-56587)

leds: class: Protect brightnessshow with ledcdev-ledaccess mutex. There is NULL pointer vulnerability observed if from Process A where hid device being added which results in adding a ledcdev addition and later a another call to access of ledcdev attribute from Process B can result in NULL pointe...