Executive brief
The Linux kernel's Intel HID touchscreen driver (intel-quickspi component) fails to validate the size of device-supplied HID reports before copying them into caller-provided buffers. A malicious or malfunctioning touch controller can send oversized reports that overflow the kernel buffer, potentially allowing privilege escalation, kernel crash, or other system compromise.
Technical details
The vulnerability is a classic buffer overflow in the quickspi_get_report() function within the Intel Quick SPI HID driver. The function receives a caller-supplied buffer (buf) and its length (len), but the quickspi_get_report() call never received the buffer length parameter. Instead, it blindly copied the entire device-supplied report (qsdev->report_len bytes) into buf using memcpy(), regardless of buf's actual capacity. Since report_len is controlled by the remote touch controller and buf is sized according to user requests via HIDIOCGFEATURE or HIDIOCGINPUT, an attacker can craft a device that reports a larger-than-expected payload to trigger an overflow. The fix adds the buf_len parameter to quickspi_get_report(), validates that report_len ≤ buf_len before copying, and returns -EINVAL if exceeded. This mirrors the existing protection in the intel-quicki2c sibling driver. A patch was committed to the Linux kernel main branch on 2026-08-14 and backported to stable series by 2026-09-07.
Affected products
- Linux Linux kernel affected versions prior to fix commit 035ec4a71cb8020a927c123bbe75c2f88d614986 (2026-08-14)
Timeline
- 2026-09-11: disclosed: CVE-2026-89619 published on NVD
- 2026-08-14: patched: Fix committed to Linux kernel main branch by Jiri Kosina
- 2026-09-07: patched: Fix backported to stable kernel series by Greg Kroah-Hartman