Executive brief
The Linux kernel's HID-BPF subsystem contains an integer overflow vulnerability in the hid_bpf_get_data() function, which is used to access HID device data from eBPF programs. An attacker can exploit this by providing specially crafted offset and size values that wrap around during addition, bypassing bounds checks and allowing out-of-bounds memory access. This could lead to information disclosure or kernel code execution.
Technical details
The vulnerability exists in the hid_bpf_get_data() function in drivers/hid/bpf/hid_bpf_dispatch.c. The original code performs a bounds check by adding rdwr_buf_size and offset (both unsigned types) and comparing against ctx->allocated_size. However, since both values are unsigned integers, a sufficiently large rdwr_buf_size can cause the sum to wrap around to a small value, passing the bounds check even though the requested range exceeds the allocated buffer. The fix uses check_add_overflow() to detect wrapping before the bounds comparison. An attacker with the ability to load eBPF programs (typically requiring root or specific capabilities) can trigger this code path to read out-of-bounds kernel memory or potentially achieve code execution.
Affected products
- Linux Linux kernel 5.10 and later versions (affected versions include linux-5.10.y through linux-7.2.y and master)
Timeline
- 2026-08-15: disclosed
- 2026-06-23: patched: Upstream fix commit 2d044049421dd48212b28646a850749d4a2d57fa