Medium 5.5Published Aug 16, 2025

CVE-2025-38507HID: nintendo: avoid bluetooth suspend/resume stalls

Updated under an hour ago (2026-10-21 22:50 UTC)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: avoid bluetooth suspend/resume stalls Ensure we don't stall or panic the kernel when using bluetooth-connected controllers. This was reported as an issue on android devices using kernel 6.6 due to the resume hook which had been added for usb joycons. First, set a new state value to JOYCON_CTLR_STATE_SUSPENDED in a newly-added nintendo_hid_suspend. This makes sure we will not stall out the kernel waiting for input reports during led classdev suspend. The stalls could happen if connectivity is unreliable or lost to the controller prior to suspend. Second, since we lose connectivity during suspend, do not try joycon_init() for bluetooth controllers in the nintendo_hid_resume path. Tested via multiple suspend/resume flows when using the controller both in USB and bluetooth modes.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 21, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2af16c1f846bd60240745bbd3afa13d5f040c61a before d3c8519f85b786dcae2498b3496f32e3925e4601; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before 7b4a026313529a487821ef6ab494a61f12c1db08; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before 72cb7eef06a5cde42b324dea85fa11fd5bb6a08a; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before 4a0381080397e77792a5168069f174d3e56175ff	CNA record
linux linux_kernel linux:linux_kernel	from 5.16 before 6.12.39; from 6.13 before 6.15.7; 6.16; 6.16; 6.16	NVD

References

https://git.kernel.org/stable/c/d3c8519f85b786dcae2498b3496f32e3925e4601
https://git.kernel.org/stable/c/7b4a026313529a487821ef6ab494a61f12c1db08patch
https://git.kernel.org/stable/c/72cb7eef06a5cde42b324dea85fa11fd5bb6a08apatch
https://git.kernel.org/stable/c/4a0381080397e77792a5168069f174d3e56175ffpatch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.