In the Linux kernel, the following vulnerability has been resolved:
HID: core: Harden s32ton() against conversion to 0 bits
Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that.
Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does.
[ { "deprecated": false, "target": { "file": "drivers/hid/hid-core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b504146c111548ab60b6ef7aad00bfb1db05a2", "digest": { "line_hashes": [ "232085607917776995571702870195088105548", "288626439357710206068842473401099721045", "243322362220642570599741090229206941166", "195199993476652800565339862858152206753" ], "threshold": 0.9 }, "id": "CVE-2025-38556-117d1584", "signature_version": "v1" }, { "deprecated": false, "target": { "file": "drivers/hid/hid-core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@865ad8469fa24de1559f247d9426ab01e5ce3a56", "digest": { "line_hashes": [ "232085607917776995571702870195088105548", "288626439357710206068842473401099721045", "243322362220642570599741090229206941166", "195199993476652800565339862858152206753" ], "threshold": 0.9 }, "id": "CVE-2025-38556-18e4f2eb", "signature_version": "v1" }, { "deprecated": false, "target": { "file": "drivers/hid/hid-core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd", "digest": { "line_hashes": [ "232085607917776995571702870195088105548", "288626439357710206068842473401099721045", "243322362220642570599741090229206941166", "195199993476652800565339862858152206753" ], "threshold": 0.9 }, "id": "CVE-2025-38556-39e92e45", "signature_version": "v1" }, { "deprecated": false, "target": { "file": "drivers/hid/hid-core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4a94b1510f6a46ec48494b52ee8f67eb4fc836", "digest": { "line_hashes": [ "232085607917776995571702870195088105548", "288626439357710206068842473401099721045", "243322362220642570599741090229206941166", "195199993476652800565339862858152206753" ], "threshold": 0.9 }, "id": "CVE-2025-38556-3c0abe16", "signature_version": "v1" }, { "deprecated": false, "target": { "file": "drivers/hid/hid-core.c", "function": "s32ton" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@865ad8469fa24de1559f247d9426ab01e5ce3a56", "digest": { "length": 235.0, "function_hash": "187877533464404024693464367746482657380" }, "id": "CVE-2025-38556-66c41caf", "signature_version": "v1" }, { "deprecated": false, "target": { "file": "drivers/hid/hid-core.c", "function": "s32ton" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd", "digest": { "length": 235.0, "function_hash": "187877533464404024693464367746482657380" }, "id": "CVE-2025-38556-81692c90", "signature_version": "v1" }, { "deprecated": false, "target": { "file": "drivers/hid/hid-core.c", "function": "s32ton" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b504146c111548ab60b6ef7aad00bfb1db05a2", "digest": { "length": 235.0, "function_hash": "187877533464404024693464367746482657380" }, "id": "CVE-2025-38556-9a0274d0", "signature_version": "v1" }, { "deprecated": false, "target": { "file": "drivers/hid/hid-core.c", "function": "s32ton" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4a94b1510f6a46ec48494b52ee8f67eb4fc836", "digest": { "length": 235.0, "function_hash": "187877533464404024693464367746482657380" }, "id": "CVE-2025-38556-c37460cf", "signature_version": "v1" } ]