Executive brief
A vulnerability in the Linux kernel's Human Interface Device (HID) subsystem could allow a local user to cause a system crash or potentially execute unauthorized code. The issue exists in how the system handles requests from specialized hardware drivers (HID-BPF), where an unexpectedly large response can overflow internal memory buffers. This could lead to data corruption or a complete system failure, impacting the reliability and security of the affected machine.
Technical details
An out-of-bounds write (CWE-787) exists in the Linux kernel's HID-BPF implementation within drivers/hid/bpf/hid_bpf_dispatch.c. The function hid_bpf_hw_request() fails to validate the return value from dispatch_hid_bpf_raw_requests(), which can return an arbitrarily large value. This value is subsequently used as the length parameter in a memcpy() operation, leading to a buffer overflow if the returned size exceeds the allocated buffer. A local attacker with the ability to load or interact with HID-BPF programs could exploit this to corrupt kernel memory. Patches have been released for multiple stable branches including 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.11 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-04-03: disclosed: Initial publication of the CVE
- 2026-03-16: patched: Initial patch committed to the Linux kernel tree