CVE-2025-21992

HID: ignore non-functional sensor in HP 5MP Camera

Description

In the Linux kernel, the following vulnerability has been resolved: HID: ignore non-functional sensor in HP 5MP Camera The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. [453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff [453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff Add this device to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace.

N/A

CVSS

Severity:

EPSS 0.07%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/9af297aea8f76a0ad21f2de5f2cd6401a748b9c3
https://git.kernel.org/stable/c/b6c6c2d8ab4932e5d6d439f514276cb3d257b8fe
https://git.kernel.org/stable/c/007a849126ef7907761af6a1379400558a72e703
https://git.kernel.org/stable/c/9acdb0059fb6b82158e15adae91e629cb5974564
https://git.kernel.org/stable/c/7a7ada33879a631b05b536e66d1c5b1219d3bade
https://git.kernel.org/stable/c/6ca3d4d87af406a390a34ea924ab65c517e6e132
https://git.kernel.org/stable/c/920ea73215dbf948b661b88a79cb47b7f96adfbd
https://git.kernel.org/stable/c/363236d709e75610b628c2a4337ccbe42e454b6d

Frequently Asked Questions

What is the severity of CVE-2025-21992?: CVE-2025-21992 has not yet been assigned a CVSS score.
How to fix CVE-2025-21992?: To fix CVE-2025-21992, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-21992 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-21992 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-21992?: CVE-2025-21992 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.