CVE-2025-39806 Cert Portal CVE debrief

Who should care

Linux kernel maintainers, embedded/OT device operators, and administrators who accept untrusted or physically connected HID peripherals should prioritize this. The advisory source also lists Siemens SIMATIC CN 4100 product metadata, so Siemens-focused defenders should validate whether their deployed images or firmware include the affected kernel code path.

Technical summary

The vulnerable function mt_report_fixup() in the HID multitouch driver assumes a descriptor is large enough to inspect offset 607 and potentially rewrite that byte. When a descriptor shorter than 608 bytes is supplied, the function can read past the end of the slab object, triggering a KASAN slab-out-of-bounds report during device probing/opening. The corrective change is a bounds check that enforces a minimum descriptor length of 608 bytes before accessing offset 607.

Defensive priority

High for systems that may process untrusted HID devices or physically attached peripherals; otherwise moderate but still worth fast patching because the flaw affects kernel memory safety.

Recommended defensive actions

• Apply the vendor or kernel fix that ensures mt_report_fixup() validates a minimum descriptor size of 608 bytes before reading offset 607.
• Update to the Siemens-referenced fixed release: V5.0 or later, if the advisory applies to your deployment.
• Review where HID devices are accepted from untrusted sources, especially kiosks, lab systems, and industrial endpoints with removable peripherals.
• Limit unauthorized physical access to endpoints and USB/HID attachment points where feasible.
• Monitor kernel and device-probing logs for crashes or KASAN-like reports involving HID multitouch initialization.
• Validate whether your asset inventory actually uses the Siemens SIMATIC CN 4100 product mapping in the advisory, since the vulnerability text itself is Linux-kernel specific.

Evidence notes

Source text states: 'HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()' and explains that a malicious HID device can trigger a slab out-of-bounds when the report descriptor is smaller than 607/608 bytes. The source also includes a KASAN splat showing the read in mt_report_fixup() during hid_open_report() / mt_probe(). Remediation in the source references 'Update to V5.0 or later version.' Note: the advisory metadata maps this CVE to 'Siemens SIMATIC CN 4100 vers:intdot/<5.0', but the vulnerability description itself is clearly about the Linux kernel HID multitouch driver; that product association should be validated before operational use.

Official resources