CVE-2025-38016 in Linux
Summary
by MITRE • 06/18/2025
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: abort dispatch if device destroyed
The current HID bpf implementation assumes no output report/request will go through it after hid_bpf_destroy_device() has been called. This leads to a bug that unplugging certain types of HID devices causes a cleaned- up SRCU to be accessed. The bug was previously a hidden failure until a recent x86 percpu change [1] made it access not-present pages.
The bug will be triggered if the conditions below are met:
A) a device under the driver has some LEDs on B) hid_ll_driver->request() is uninplemented (e.g., logitech-djreceiver)
If condition A is met, hidinput_led_worker() is always scheduled *after* hid_bpf_destroy_device().
hid_destroy_device ` hid_bpf_destroy_device ` cleanup_srcu_struct(&hdev->bpf.srcu) ` hid_remove_device ` ... ` led_classdev_unregister ` led_trigger_set(led_cdev, NULL) ` led_set_brightness(led_cdev, LED_OFF) ` ... ` input_inject_event ` input_event_dispose ` hidinput_input_event ` schedule_work(&hid->led_work) [hidinput_led_worker]
This is fine when condition B is not met, where hidinput_led_worker() calls hid_ll_driver->request(). This is the case for most HID drivers, which implement it or use the generic one from usbhid. The driver itself or an underlying driver will then abort processing the request.
Otherwise, hidinput_led_worker() tries hid_hw_output_report() and leads to the bug.
hidinput_led_worker ` hid_hw_output_report ` dispatch_hid_bpf_output_report ` srcu_read_lock(&hdev->bpf.srcu) ` srcu_read_unlock(&hdev->bpf.srcu, idx)
The bug has existed since the introduction [2] of
dispatch_hid_bpf_output_report(). However, the same bug also exists in dispatch_hid_bpf_raw_requests(), and I've reproduced (no visible effect because of the lack of [1], but confirmed bpf.destroyed == 1) the bug
against the commit (i.e., the Fixes:) introducing the function. This is because hidinput_led_worker() falls back to hid_hw_raw_request() when hid_ll_driver->output_report() is uninplemented (e.g., logitech- djreceiver).
hidinput_led_worker ` hid_hw_output_report: -ENOSYS ` hid_hw_raw_request ` dispatch_hid_bpf_raw_requests ` srcu_read_lock(&hdev->bpf.srcu) ` srcu_read_unlock(&hdev->bpf.srcu, idx)
Fix the issue by returning early in the two mentioned functions if hid_bpf has been marked as destroyed. Though dispatch_hid_bpf_device_event() handles input events, and there is no evidence that it may be called after the destruction, the same check, as a safety net, is also added to it to maintain the consistency among all dispatch functions.
The impact of the bug on other architectures is unclear. Even if it acts as a hidden failure, this is still dangerous because it corrupts whatever is on the address calculated by SRCU. Thus, CC'ing the stable list.
[1]: commit 9d7de2aa8b41 ("x86/percpu/64: Use relative percpu offsets")
[2]: commit 9286675a2aed ("HID: bpf: add HID-BPF hooks for
hid_hw_output_report")
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/02/2026
The vulnerability CVE-2025-38016 resides within the Linux kernel's HID (Human Interface Device) BPF (Berkeley Packet Filter) subsystem, specifically in how it handles device destruction and subsequent event dispatching. This flaw manifests when certain HID devices are unplugged while they still have LED indicators active, leading to a potential use-after-free condition or access to freed memory structures. The root cause lies in the assumption that no output reports or requests will proceed after `hid_bpf_destroy_device()` is invoked, which is violated under specific device configurations.
The technical flaw occurs due to improper synchronization handling in the SRCU (Sleepable Read-Copy Update) mechanism used by the HID BPF subsystem. When a device is removed and `hid_bpf_destroy_device()` is called, the SRCU structure is cleaned up via `cleanup_srcu_struct()`. However, pending work items such as `hidinput_led_worker()` may still execute afterward, attempting to access the now-invalidated SRCU structure through functions like `dispatch_hid_bpf_output_report()` or `dispatch_hid_bpf_raw_requests()`. These functions perform `srcu_read_lock()` and `srcu_read_unlock()` operations on the destroyed structure, causing memory access violations that can lead to system instability or exploitation.
The operational impact of this vulnerability is significant for systems running Linux kernels with HID BPF support and handling certain types of HID devices, particularly those from Logitech's DJ receiver series where the `hid_ll_driver->request()` function is not implemented. This condition triggers the execution path that leads to accessing freed memory, which becomes exploitable after recent x86 percpu changes that expose invalid memory access patterns. The vulnerability is not architecture-specific but may manifest differently depending on memory layout and kernel configurations, making it a latent issue that could remain undetected until triggered by specific hardware or kernel state changes.
Mitigation of this vulnerability requires early return checks in `dispatch_hid_bpf_output_report()` and `dispatch_hid_bpf_raw_requests()` functions when the HID BPF device has been marked as destroyed. This approach aligns with security best practices for preventing use-after-free conditions and aligns with the ATT&CK framework's T1068 (Local Privilege Escalation) and T1203 (Exploitation for Client Execution) techniques by preventing potential memory corruption that could lead to privilege escalation. The fix also includes adding similar safety checks to `dispatch_hid_bpf_device_event()` to maintain consistency across all dispatch functions, following CWE-416 (Use After Free) remediation patterns. This vulnerability demonstrates the importance of proper synchronization and cleanup procedures in kernel subsystems, particularly those involving asynchronous work items and memory management mechanisms like SRCU.
The vulnerability was introduced in commit 9286675a2aed related to HID-BPF hooks for `hid_hw_output_report()` and affects the broader HID subsystem's BPF integration. While the bug existed since its introduction, it was only recently exposed due to architectural changes in x86 percpu handling described in commit 9d7de2aa8b41. This highlights the critical nature of kernel stability updates and the importance of thorough testing across different architectures and hardware configurations when introducing new subsystem features. The vulnerability affects kernel versions that include the HID BPF functionality and should be prioritized for patching in production systems to prevent potential exploitation through memory corruption attacks.