User-After-Free Vulnerability in ASUS HID Devices from Linux Kernel

CVE-2025-39824

What is CVE-2025-39824?

A user-after-free vulnerability exists in ASUS HID devices managed by the Linux kernel. This flaw allows a malicious HID device, such as a specially crafted ASUS ROG N-Key keyboard, to exploit the system. The vulnerability arises when the hid_hw_start() function inappropriately processes the device descriptors, potentially bypassing capability bitmap configurations. This leads to improper handling of memory, allowing the attacker to manipulate the freed memory space, resulting in possible data corruption or arbitrary code execution. These factors highlight the critical need for robust validation and error management in HID device connectivity.

References