CVE-2025-38507 Details
Description
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: avoid bluetooth suspend/resume stalls Ensure we don't stall or panic the kernel when using bluetooth-connected controllers. This was reported as an issue on android devices using kernel 6.6 due to the resume hook which had been added for usb joycons. First, set a new state value to JOYCON_CTLR_STATE_SUSPENDED in a newly-added nintendo_hid_suspend. This makes sure we will not stall out the kernel waiting for input reports during led classdev suspend. The stalls could happen if connectivity is unreliable or lost to the controller prior to suspend. Second, since we lose connectivity during suspend, do not try joycon_init() for bluetooth controllers in the nintendo_hid_resume path. Tested via multiple suspend/resume flows when using the controller both in USB and bluetooth modes.
A vulnerability in the Linux kernel's handling of Bluetooth-connected Nintendo controllers can lead to kernel stalls or panics. This issue, observed on Android devices with kernel 6.6, arises from a resume hook added for USB Joy-Con controllers. The problem occurs when the kernel waits for input reports during the LED class device suspend, potentially causing a stall if the controller loses connectivity before the suspend process. The vulnerability has been addressed by introducing a new suspend function that sets the controller's state to 'suspended', preventing the kernel from stalling. Additionally, the resume function for Bluetooth controllers has been modified to avoid reinitializing the Joy-Con, as connectivity is lost during the suspend phase.
The vulnerability has been fixed in the Linux kernel. Users can upgrade to the latest version of the stable Linux kernel to apply the patch.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/4a0381080397e77792a5168069f174d3e56175ff | kernel.org | Patch |
| https://git.kernel.org/stable/c/72cb7eef06a5cde42b324dea85fa11fd5bb6a08a | kernel.org | Patch |
| https://git.kernel.org/stable/c/7b4a026313529a487821ef6ab494a61f12c1db08 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.16, < 6.12.39 >= 6.13, < 6.15.7 6.16 rc1 6.16 rc2 6.16 rc3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 19, 2025 | Initial Analysis | [email protected] |
| Aug 16, 2025 | New CVE Received | kernel.org |