high 7.1

CVE-2024-57986 json

HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections

published 2025-02-27 20 mo ago modified 2026-10-15 25 d ago also EUVD-2025-5263

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated with Resolution Multipliers. One of the errors was fixed by commit ea427a222d8b ("HID: core: Fix deadloop in hid_apply_multiplier."), but the other has not been fixed.

This error arises because hid_apply_multipler() assumes that every Resolution Multiplier control is contained in a Logical Collection, i.e., there's no way the routine can ever set multiplier_collection to NULL. This is in spite of the fact that the function starts with a big comment saying:

* "The Resolution Multiplier control must be contained in the same * Logical Collection as the control(s) to which it is to be applied. ... * If no Logical Collection is * defined, the Resolution Multiplier is associated with all * controls in the report." * HID Usage Table, v1.12, Section 4.3.1, p30 * * Thus, search from the current collection upwards until we find a * logical collection...

The comment and the code overlook the possibility that none of the collections found may be a Logical Collection.

The fix is to set the multiplier_collection pointer to NULL if the collection found isn't a Logical Collection.

Patch / fix

fixed in 1 distros 6 links 8

Linux Linux 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.76, 6.12.13, 6.13.2, 6.14

debian ubuntu red hat suse almalinux rocky linux

linux Debian 12 6.1.129-1
linux Debian 14, Debian 13 6.12.13-1

debian advisories DEBIAN-CVE-2024-57986

linux Ubuntu 20.04 LTS 5.4.0-216.236
linux Ubuntu 22.04 LTS 5.15.0-140.150
linux Ubuntu 24.04 LTS 6.8.0-64.67
linux-aws Ubuntu 20.04 LTS 5.4.0-1146.156
linux-aws Ubuntu 22.04 LTS 5.15.0-1084.91
linux-aws Ubuntu 24.04 LTS 6.8.0-1032.34
linux-gcp Ubuntu 20.04 LTS 5.4.0-1149.158
linux-gcp Ubuntu 22.04 LTS 5.15.0-1083.92

ubuntu advisories UBUNTU-CVE-2024-57986

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-611.5.1.el9_7
rv RHEL 9 5.14.0-611.5.1.el9_7
perf RHEL 9 5.14.0-611.5.1.el9_7
rtla RHEL 9 5.14.0-611.5.1.el9_7
libperf RHEL 9 5.14.0-611.5.1.el9_7
kernel-rt RHEL 9 5.14.0-611.5.1.el9_7
kernel-64k RHEL 9 5.14.0-611.5.1.el9_7
kernel-core RHEL 9 5.14.0-611.5.1.el9_7

red hat advisories RHSA-2025:20518 RHSA-2025:20095

kernel-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
kernel-syms-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
kernel-coco_debug SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
kernel-source-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1
kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1
kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1
kernel-default-base Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1.21.6

suse advisories SUSE-SU-2025:01919-1 SUSE-SU-2025:20192-1 SUSE-SU-2025:20270-1 SUSE-SU-2025:20190-1 SUSE-SU-2025:20260-1 SUSE-SU-2025:1180-1

kernel AlmaLinux 10 6.12.0-124.8.1.el10_1
rv AlmaLinux 10 6.12.0-124.8.1.el10_1
perf AlmaLinux 10 6.12.0-124.8.1.el10_1
rtla AlmaLinux 10 6.12.0-124.8.1.el10_1
libperf AlmaLinux 10 6.12.0-124.8.1.el10_1
kernel-rt AlmaLinux 10 6.12.0-124.8.1.el10_1
kernel-64k AlmaLinux 10 6.12.0-124.8.1.el10_1
kernel-core AlmaLinux 10 6.12.0-124.8.1.el10_1

almalinux advisories ALSA-2025:20095 ALSA-2025:20518

kernel Rocky Linux 10 6.12.0-124.8.1.el10_1
kernel Rocky Linux 9 5.14.0-611.5.1.el9_7

rocky linux advisories RLSA-2025:20095 RLSA-2025:20518

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-57986 updated 2026-11-05 cvss 4.4

kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-611.5.1.el9_7, perf 5.14.0-611.5.1.el9_7, rtla 5.14.0-611.5.1.el9_7, python3-perf 5.14.0-611.5.1.el9_7, kernel-devel-matched 5.14.0-611.5.1.el9_7, kernel-64k-devel-matched 5.14.0-611.5.1.el9_7, +7 more
fixed: vendor fix RHSA-2025:20518
Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-124.8.1.el10_1, perf 6.12.0-124.8.1.el10_1, rtla 6.12.0-124.8.1.el10_1, python3-perf 6.12.0-124.8.1.el10_1, kernel-devel-matched 6.12.0-124.8.1.el10_1, kernel-64k-devel-matched 6.12.0-124.8.1.el10_1, +7 more
fixed: vendor fix RHSA-2025:20095
Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-611.5.1.el9_7, kernel-64k 5.14.0-611.5.1.el9_7, kernel-core 5.14.0-611.5.1.el9_7, kernel-tools 5.14.0-611.5.1.el9_7, kernel-modules 5.14.0-611.5.1.el9_7, kernel-64k-core 5.14.0-611.5.1.el9_7, +27 more
fixed: vendor fix RHSA-2025:20518
Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-124.8.1.el10_1, kernel-64k 6.12.0-124.8.1.el10_1, kernel-core 6.12.0-124.8.1.el10_1, kernel-tools 6.12.0-124.8.1.el10_1, kernel-modules 6.12.0-124.8.1.el10_1, kernel-64k-core 6.12.0-124.8.1.el10_1, +28 more
fixed: vendor fix RHSA-2025:20095
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-s390x 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-x86_64 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-aarch64 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-ppc64le 5.14.0-611.5.1.el9_7
fixed: vendor fix RHSA-2025:20518
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-124.8.1.el10_1, kernel-debuginfo-common-s390x 6.12.0-124.8.1.el10_1, kernel-debuginfo-common-x86_64 6.12.0-124.8.1.el10_1, kernel-debuginfo-common-aarch64 6.12.0-124.8.1.el10_1, kernel-debuginfo-common-ppc64le 6.12.0-124.8.1.el10_1
fixed: vendor fix RHSA-2025:20095
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-611.5.1.el9_7, kernel-rt-64k 5.14.0-611.5.1.el9_7, kernel-rt-core 5.14.0-611.5.1.el9_7, kernel-rt-modules 5.14.0-611.5.1.el9_7, kernel-rt-64k-core 5.14.0-611.5.1.el9_7, kernel-rt-debug-core 5.14.0-611.5.1.el9_7, +14 more
fixed: vendor fix RHSA-2025:20518

show 3 more

Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-124.8.1.el10_1, kernel-rt-64k 6.12.0-124.8.1.el10_1, kernel-rt-core 6.12.0-124.8.1.el10_1, kernel-rt-modules 6.12.0-124.8.1.el10_1, kernel-rt-64k-core 6.12.0-124.8.1.el10_1, kernel-rt-debug-core 6.12.0-124.8.1.el10_1, +14 more
fixed: vendor fix RHSA-2025:20095
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-611.5.1.el9_7, kernel-rt-core 5.14.0-611.5.1.el9_7, kernel-rt-modules 5.14.0-611.5.1.el9_7, kernel-rt-debug-core 5.14.0-611.5.1.el9_7, kernel-rt-modules-core 5.14.0-611.5.1.el9_7, kernel-rt-debug-modules 5.14.0-611.5.1.el9_7, +4 more
fixed: vendor fix RHSA-2025:20518
Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-124.8.1.el10_1, kernel-rt-core 6.12.0-124.8.1.el10_1, kernel-rt-modules 6.12.0-124.8.1.el10_1, kernel-rt-debug-core 6.12.0-124.8.1.el10_1, kernel-rt-modules-core 6.12.0-124.8.1.el10_1, kernel-rt-debug-modules 6.12.0-124.8.1.el10_1, +4 more
fixed: vendor fix RHSA-2025:20095

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-295-16 updated 2026-10-22 cvss 7.1

Siemens SIMATIC S7-1500 TM MFP

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-102-01 updated 2026-05-14 cvss 5.5

Siemens SIMATIC S7-1500 TM MFP

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Classification

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2024-57986
NVD CVE-2024-57986

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary