Executive brief
The Linux kernel's HID (Human Interface Device) subsystem contains an out-of-bounds memory read vulnerability in the hid_set_field() function. When processing input from certain HID devices (such as USB framebuffer devices), the kernel may read memory beyond the bounds of an allocated array, potentially exposing kernel memory contents or causing a kernel crash. This affects systems with HID devices and kernel debug features enabled.
Technical details
The vulnerability is an out-of-bounds (OOB) read in the HID core hid_set_field() function. The root cause is that hid_dump_input() is called with a pointer to field->usage + offset before the offset value is validated against field->report_count. The hid_dump_input() function dereferences this pointer via hid_resolv_usage() when CONFIG_DEBUG_FS is enabled, reading beyond the bounds of the usage[] array. The picolcd_fb_send_tile() function triggers this by calling hid_set_field() with offsets 11–42 that are not validated against the field's maxusage. The fix moves the hid_dump_input() call after the bounds check, ensuring offset is confirmed to be within field->report_count (and thus within maxusage) before dereferencing the pointer.
Affected products
- Linux Linux kernel <unknown>
Timeline
- 2026-09-04: disclosed