Executive brief
The Linux kernel's HID (Human Interface Device) subsystem has a type confusion bug where pointer values are incorrectly interpreted as numeric values when processing long-format HID descriptors. When a malicious or malformed HID device is connected, this can leak kernel pointer values to system logs, which aids attackers in bypassing kernel address space layout randomization (KASLR). While the immediate observable impact is information disclosure to dmesg, this information leakage reduces the effectiveness of a key kernel security feature.
Technical details
The vulnerability is a type confusion issue in the HID core parsing code. When fetch_item() encounters a long-format HID item (HID_ITEM_TAG_LONG), it stores a pointer to item data in item->data.longdata. However, the item_udata() and item_sdata() accessor functions incorrectly assume all items are in short format and directly interpret the pointer memory as unsigned or signed integers. This allows the lower half of kernel pointers to be leaked to dmesg when processing a HID descriptor with a long-format HID_GLOBAL_ITEM_TAG_REPORT_SIZE item with size=4. The bug is triggered when a HID device is connected; no authentication or prior system compromise is required. A patch adds format validation checks in item_udata() and item_sdata() to return 0 for non-short format items. The issue was introduced by commit 3dc8fc083dbf and affects HID scanning only; main parsing logic exits before encountering long items.
Affected products
- Linux Linux kernel versions prior to fix (affected via HID subsystem across most kernel versions)
Timeline
- 2026-09-09: disclosed: CVE published and details disclosed
- 2026-08-03: patched: Fix committed upstream by Jiri Kosina
- 2026-08-27: patched: Fix backported to stable tree