Linux Kernel up to 6.1.131/6.6.83/6.12.19/6.13.7 HID denial of service

Summaryinfo

A vulnerability classified as critical has been found in Linux Kernel up to 6.1.131/6.6.83/6.12.19/6.13.7. The affected element is an unknown function of the component HID. This manipulation causes denial of service. This vulnerability is handled as CVE-2025-21992. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.1.131/6.6.83/6.12.19/6.13.7. It has been declared as critical. Affected by this vulnerability is some unknown processing of the component HID. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: HID: ignore non-functional sensor in HP 5MP Camera The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. [453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff [453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff Add this device to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace.

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2025-21992 since 12/29/2024. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 234309 (Debian dsa-5900 : affs-modules-6.1.0-28-4kc-malta-di - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.1.132, 6.6.84, 6.12.20 or 6.13.8 eliminates this vulnerability. Applying the patch 9acdb0059fb6b82158e15adae91e629cb5974564/7a7ada33879a631b05b536e66d1c5b1219d3bade/6ca3d4d87af406a390a34ea924ab65c517e6e132/920ea73215dbf948b661b88a79cb47b7f96adfbd/363236d709e75610b628c2a4337ccbe42e454b6d is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (234309) and CERT Bund (WID-SEC-2025-0698). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Open Source Linux Kernel
• SolarWinds Security Event Manager
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.1.131
• 6.6.0
• 6.6.1
• 6.6.2
• 6.6.3
• 6.6.4
• 6.6.5
• 6.6.6
• 6.6.7
• 6.6.8
• 6.6.9
• 6.6.10
• 6.6.11
• 6.6.12
• 6.6.13
• 6.6.14
• 6.6.15
• 6.6.16
• 6.6.17
• 6.6.18
• 6.6.19
• 6.6.20
• 6.6.21
• 6.6.22
• 6.6.23
• 6.6.24
• 6.6.25
• 6.6.26
• 6.6.27
• 6.6.28
• 6.6.29
• 6.6.30
• 6.6.31
• 6.6.32
• 6.6.33
• 6.6.34
• 6.6.35
• 6.6.36
• 6.6.37
• 6.6.38
• 6.6.39
• 6.6.40
• 6.6.41
• 6.6.42
• 6.6.43
• 6.6.44
• 6.6.45
• 6.6.46
• 6.6.47
• 6.6.48
• 6.6.49
• 6.6.50
• 6.6.51
• 6.6.52
• 6.6.53
• 6.6.54
• 6.6.55
• 6.6.56
• 6.6.57
• 6.6.58
• 6.6.59
• 6.6.60
• 6.6.61
• 6.6.62
• 6.6.63
• 6.6.64
• 6.6.65
• 6.6.66
• 6.6.67
• 6.6.68
• 6.6.69
• 6.6.70
• 6.6.71
• 6.6.72
• 6.6.73
• 6.6.74
• 6.6.75
• 6.6.76
• 6.6.77
• 6.6.78
• 6.6.79
• 6.6.80
• 6.6.81
• 6.6.82
• 6.6.83
• 6.12.0
• 6.12.1
• 6.12.2
• 6.12.3
• 6.12.4
• 6.12.5
• 6.12.6
• 6.12.7
• 6.12.8
• 6.12.9
• 6.12.10
• 6.12.11
• 6.12.12
• 6.12.13
• 6.12.14
• 6.12.15
• 6.12.16
• 6.12.17
• 6.12.18
• 6.12.19
• 6.13.0
• 6.13.1
• 6.13.2
• 6.13.3
• 6.13.4
• 6.13.5
• 6.13.6
• 6.13.7

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion