CVE-2025-39806: 
Linux Kernel vulnerability analysis and mitigation

A slab out-of-bounds vulnerability has been identified in the Linux kernel's HID multitouch subsystem (CVE-2025-39806). The vulnerability was discovered and published to the CVE List on September 16, 2025, affecting the Linux kernel's mtreportfixup() function (NVD).

The vulnerability exists in the mtreportfixup() function where a malicious HID device can trigger a slab out-of-bounds access by providing a report descriptor smaller than 607 bytes. The function attempts to patch byte offset 607 of the descriptor with 0x25 by checking if byte offset 607 is 0x15, but lacks proper bounds checks to verify if the descriptor is large enough before conducting this check (NVD).

When exploited, this vulnerability can lead to a slab out-of-bounds access, potentially causing system crashes or memory corruption. The issue was detected by KASAN (Kernel Address Sanitizer) which reported a slab-out-of-bounds read of size 1 during the execution of mtreportfixup (NVD).

The vulnerability has been fixed by implementing proper bounds checking in the mtreportfixup() function. The fix ensures that the descriptor size is at least 608 bytes before attempting to access it (NVD).