An out-of-bounds vulnerability in the Linux kernel HID subsystem could allow local network attackers to achieve high impact compromise.

This is an out-of-bounds read and write vulnerability caused by a bogus memset operation within the hid_report_raw_event function. The attack vector is adjacent network access with low complexity and no privileges or user interaction required.

Successful exploitation of this kernel vulnerability can lead to complete system compromise, including high impacts on confidentiality, integrity, and availability. With a CVSS score of 8.8, the severity is classified as high, reflecting the potential for arbitrary code execution and kernel panic which causes severe system downtime and data exposure.

Immediate Action: Update the Linux kernel to version 6.18.22, 6.19.12, or later, where the vulnerable memset function has been removed.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unusual driver behavior related to HID devices.

Compensating Controls: Restrict adjacent network access to vulnerable systems and ensure strict input validation on connected Human Interface Devices.

Public Exploit Available: No

Administrators must prioritize updating affected Linux kernel instances immediately to prevent potential out-of-bounds memory corruption. Applying the official kernel patches is essential to neutralizing the risk of arbitrary code execution and maintaining operating system integrity.