cve 2025 38103

CVE-2025-38103 is a Linux kernel bug in the USB HID subsystem, specifically an out-of-bounds issue in usbhid_parse(). The fix has been applied to kernel stable trees. Microsoft's Security Response Center (MSRC) issued an attestation that Azure Linux includes the affected open-source component and is potentially vulnerable. This is an inventory attestation, not a guarantee that other Microsoft products are unaffected. Administrators should prioritize remediation for Azure Linux while monitoring for broader impact. The tag covers discussion of the vulnerability, its fix, and Microsoft's official response regarding Azure Linux.