Executive brief
The Linux kernel's HID (Human Interface Device) subsystem has a vulnerability in how it processes numbered reports from input devices. When processing a malformed or malicious input device report with zero size, the kernel can read memory outside the intended buffer or crash, potentially leading to information disclosure or denial of service on systems with attached or compromised USB/HID devices.
Technical details
The vulnerability is an out-of-bounds (OOB) read in the hid_report_raw_event() function in drivers/hid/hid-core.c. When a caller passes a size of 0 for a numbered report, the function originally called hid_get_report() before validating the buffer size. Inside hid_get_report(), the code unconditionally dereferences data[0] to extract the report ID without checking if the buffer has at least one byte. The fix adds a size validation check before the call to hid_get_report(), ensuring that both size and bufsize are at least 1 for numbered reports. No authentication is required; the attack vector is through a malicious or compromised HID device. The patch has been committed and is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple versions (2.6.11 through 7.2)
Timeline
- 2026-08-28: disclosed
- 2026-06-29: patched: Upstream commit af1a9b65ebe8a948eda805c14b78d4d0767cb1b5
- 2026-07-24: patched: Stable tree backport commit 30ff978af92cb51c9ba99f96fc4f4ac80d7001ba