---
id: CVE-2026-97538
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  hwmon: (asus_rog_ryujin) Validate HID report lengths

  rog_ryujin_raw_event() parses response headers and payload fields without
  first checking that they are present in …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  hwmon: (asus_rog_ryujin) Validate HID report lengths

  rog_ryujin_raw_event() parses response headers and payload fields without
  first checking that they are present in …
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ed3e03790c5c9f29f032dde9bb784e198984a759 <
    1caa5f9399ff107a8fa221b1eaca0a9e729d3758
  - >-
    Linux >= ed3e03790c5c9f29f032dde9bb784e198984a759 <
    8042312e73c50de82634ce63eae7cf219464b481
  - Linux 6.9
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:04.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97538'
references:
  - url: 'https://git.kernel.org/stable/c/1caa5f9399ff107a8fa221b1eaca0a9e729d3758'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8042312e73c50de82634ce63eae7cf219464b481'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97538.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97538'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541222'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97538'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97538'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97538.mbox
  - url: 'https://git.kernel.org/stable/c/995f22b2881835b518b3f99240d00781c9df0235'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-25T11:06:38.922Z'
epss: 0.00198
epssPercentile: 0.09547
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-908
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (asus_rog_ryujin) Validate HID report lengths

rog_ryujin_raw_event() parses response headers and payload fields without
first checking that they are present in the received report. A short report
can therefore make the driver consume uninitialized bytes from the HID
transport buffer and expose them as sensor values through sysfs.

Validate the response header and the fields used by each response type
before parsing them.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97538.json)