CVE-2024-57986: linux kernel — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated with Resolution Multipliers. One of the errors was fixed by commit ea427a222d8b ("HID: core: Fix deadloop in hid_apply_multiplier."), but the other has not been fixed. This error arises because hid_apply_multipler() assumes that every Resolution Multiplier control is contained in a Logical Collection, i.e., there's no way the routine can ever set multiplier_collection to NULL. This is in spite of the fact that the function starts with a big comment saying: * "The Resolution Multiplier control must be contained in the same * Logical Collection as the control(s) to which it is to be applied. ... * If no Logical Collection is * defined, the Resolution Multiplier is associated with all * controls in the report." * HID Usage Table, v1.12, Section 4.3.1, p30 * * Thus, search from the current collection upwards until we find a * logical collection... The comment and the code overlook the possibility that none of the collections found may be a Logical Collection. The fix is to set the multiplier_collection pointer to NULL if the collection found isn't a Logical Collection.

Is your site exposed to CVE-2024-57986?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
linux	linux_kernel	5.0 — 5.4.291
linux	linux_kernel	5.5 — 5.10.235
linux	linux_kernel	5.11 — 5.15.179
linux	linux_kernel	5.16 — 6.1.129
linux	linux_kernel	6.2 — 6.6.76
linux	linux_kernel	6.7 — 6.12.13
linux	linux_kernel	6.13 — 6.13.2

References

Advisories & Patches

https://git.kernel.org/stable/c/05dd7d10675b540b8b7b31035c0a8abb6e6f3b88 https://git.kernel.org/stable/c/3a002e4029230d9a6be89f869b2328b258612f5c https://git.kernel.org/stable/c/64f2657b579343cf923aa933f08074e6258eb07b https://git.kernel.org/stable/c/a32ea3f982b389ea43a41ce77b6fb70d74006d9b https://git.kernel.org/stable/c/a5498f1f864ea26f4c613c77f54409c776a95a90 https://git.kernel.org/stable/c/bebf542e8d7c44a18a95f306b1b5dc160c823506 https://git.kernel.org/stable/c/ebaeca33d32c8bdb705a8c88267737a456f354b1 https://git.kernel.org/stable/c/ed3d3883476423f337aac0f22c521819b3f1e970

Other References

https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Frequently Asked Questions

What is CVE-2024-57986? +

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated with Resolution Multipliers. One of the errors was fixed by commit ea427a222d8b ("HID: core: Fix deadloop in hid_apply_multiplier."), but the other has not been fixed. This error arises because hid_apply_multipler() assumes that every Resolution Multiplier control is contained in a Logical Collection, i.e., there's no way the routine can ever set multiplier_collection to NULL. This is in spite of the fact that the function starts with a big comment saying: * "The Resolution Multiplier control must be contained in the same * Logical Collection as the control(s) to which it is to be applied. ... * If no Logical Collection is * defined, the Resolution Multiplier is associated with all * controls in the report." * HID Usage Table, v1.12, Section 4.3.1, p30 * * Thus, search from the current collection upwards until we find a * logical collection... The comment and the code overlook the possibility that none of the collections found may be a Logical Collection. The fix is to set the multiplier_collection pointer to NULL if the collection found isn't a Logical Collection. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-57986? +

CVE-2024-57986 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-57986? +

CVE-2024-57986 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-57986? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-9588 10.0

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. …

CVE-2025-57870 10.0

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This …

CVE-2026-48286 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2026-13782 10.0

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer …

CVE-2026-48303 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2025-34028 10.0

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when …

CVE-2024-57986