Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0030 22.4 —
AFFECTED Product Versions Fixed Linux 4fa5a7f76cc7b6ac87f57741edd2b124851d119f – — Linux 3.15 – 5.4.297
TIMELINE Apr 16 Reserved by Linux Jul 28 Published (CNA: Linux) Jul 30 RESCORED — CVE-2025-38495 (Linux). CVSS 8.8 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, meaning that instead of having 8 guaranteed bytes for implement to be working, we only have 7.
| Date | Event | Detail |
|---|---|---|
| April 16, 2025 | Reserved | Reserved by Linux |
| July 28, 2025 | Published | Published (CNA: Linux) |
| July 30, 2026 | RESCORED | RESCORED — CVE-2025-38495 (Linux). CVSS 8.8 → 5.5 (NVD). |
Authoritative record: CVE-2025-38495 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-38495 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.