CVE-2026-97538 hwmon: (asus_rog_ryujin) Validate HID report lengths
A missing length check in the ASUS ROG Ryujin kernel driver allows local attackers to read uninitialized memory via sysfs sensor values.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97538?
CVE-2026-97538 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (asus_rog_ryujin) Validate HID report lengths
rog_ryujin_raw_event() parses response headers and payload fields without first checking that they are present in the received report. A short report can therefore make the driver consume uninitialized bytes from the HID transport buffer and expose them as sensor values through sysfs.
Validate the response header and the fields used by each response type before parsing them.
Which versions are affected by CVE-2026-97538?
How do I fix CVE-2026-97538?
Apply the vendor's patch.
Is CVE-2026-97538 being exploited?
There is no known exploitation of CVE-2026-97538 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-97538, DEBIAN-CVE-2026-97538, GHSA-vm2r-8r3p-32cf, UBUNTU-CVE-2026-97538.