{"cve":"CVE-2026-97538","nvd":{"published":"2026-09-25T11:17:04.080","modified":"2026-10-21T13:21:13.280","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (asus_rog_ryujin) Validate HID report lengths\n\nrog_ryujin_raw_event() parses response headers and payload fields without\nfirst checking that they are present in the received report. A short report\ncan therefore make the driver consume uninitialized bytes from the HID\ntransport buffer and expose them as sensor values through sysfs.\n\nValidate the response header and the fields used by each response type\nbefore parsing them.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/1caa5f9399ff107a8fa221b1eaca0a9e729d3758","https://git.kernel.org/stable/c/8042312e73c50de82634ce63eae7cf219464b481","https://git.kernel.org/stable/c/995f22b2881835b518b3f99240d00781c9df0235"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-97538","score":0.00198,"percentile":0.0953,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}