{"id":"CVE-2025-39818","summary":"HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save\n\nImproper use of secondary pointer (&dev-\u003ei2c_subip_regs) caused\nkernel crash and out-of-bounds error:\n\n BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510\n Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107\n\n CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)\n Workqueue: async async_run_entry_fn\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x76/0xa0\n  print_report+0xd1/0x660\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? kasan_complete_mode_report_info+0x26/0x200\n  kasan_report+0xe1/0x120\n  ? _regmap_bulk_read+0x449/0x510\n  ? _regmap_bulk_read+0x449/0x510\n  __asan_report_store4_noabort+0x17/0x30\n  _regmap_bulk_read+0x449/0x510\n  ? __pfx__regmap_bulk_read+0x10/0x10\n  regmap_bulk_read+0x270/0x3d0\n  pio_complete+0x1ee/0x2c0 [intel_thc]\n  ? __pfx_pio_complete+0x10/0x10 [intel_thc]\n  ? __pfx_pio_wait+0x10/0x10 [intel_thc]\n  ? regmap_update_bits_base+0x13b/0x1f0\n  thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]\n  thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]\n  ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]\n[...]\n The buggy address belongs to the object at ffff888136005d00\n  which belongs to the cache kmalloc-rnd-12-192 of size 192\n The buggy address is located 0 bytes to the right of\n  allocated 192-byte region [ffff888136005d00, ffff888136005dc0)\n\nReplaced with direct array indexing (&dev-\u003ei2c_subip_regs[i]) to ensure\nsafe memory access.","modified":"2026-04-02T12:48:10.151314Z","published":"2025-09-16T13:00:18.490Z","related":["ALSA-2026:4012","ALSA-2026:4759"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39818.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/78d4cf0466c79452e47aa6f720afbde63e709ccc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a7fc15ed629be89e51e09b743277c53e0a0168f5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39818.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39818"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4228966def884c6e34b85cdc7118c5d013e1718f"},{"fixed":"78d4cf0466c79452e47aa6f720afbde63e709ccc"},{"fixed":"a7fc15ed629be89e51e09b743277c53e0a0168f5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39818.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}