CVE-2025-21794

Summary

CVE-2025-21794 is a stack-out-of-bounds read vulnerability affecting the Linux kernel. The issue was identified in the hid-thrustmaster driver, which passes an array to the usb_check_int_endpoints function from usb.c. The function iterates over this array, attempting to read elements beyond its valid bounds if no null element is found at the end of the array, leading to a kernel crash. To remedy the problem, a null element has been added to the end of the array to break the for loop, effectively preventing the out-of-bounds read. [ Sources: 1. CVE-2025-21794 - Description 2. Syzbot - Report on the vulnerability 3. Linux Kernel Bug Tracker - Potential fix implementation]

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.