A high severity vulnerability in the Linux kernel HID subsystem could allow an unauthenticated adjacent attacker to trigger a system crash or potentially execute arbitrary code.

This is an out of bounds read vulnerability occurring within the hid_get_report function. An unauthenticated attacker can trigger this condition by passing a size of 0 to hid_report_raw_event for a numbered report, causing the kernel to dereference invalid memory.

Successful exploitation of this vulnerability can lead to a kernel panic, resulting in an immediate denial of service for the affected system. Given the CVSS score of 8.8, the potential for high impact on confidentiality, integrity, and availability is significant, particularly for critical infrastructure or server environments where system uptime is paramount.

Immediate Action: Update the Linux kernel to version 5.10.261, 5.15.212, 6.1.178, 6.6.145, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages that may indicate an attempted exploitation of this HID core flaw.

Compensating Controls: Restrict physical or adjacent network access to HID devices where possible to limit the attack surface for this specific vector.

Public Exploit Available: No (exploit_available: false)

Organizations should prioritize patching their Linux kernel environments to the specified fixed versions. While the requirement for adjacent network access limits the immediate threat surface, the potential for kernel-level denial of service or code execution necessitates prompt remediation to maintain overall system integrity and stability.