AZL-66491
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-66491.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-66491
- Upstream
- Published
- 2025-08-19T17:15:31Z
- Modified
- 2026-04-01T05:20:59.215388Z
- Summary
- CVE-2025-38556 affecting package kernel for versions less than 6.6.119.3-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
HID: core: Harden s32ton() against conversion to 0 bits
Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that.
Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does.
- References