HID: core: Fix OOB read in hid_get_report for numbered reports

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-80604
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-28 08:16:44 UTC
Updated2026-10-16 20:18:03 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.

Risk And Classification

Primary CVSS: v3.1 8.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.004120000 probability, percentile 0.339480000 (date 2026-10-16)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary8.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED8.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 59bfdb41a34cf5d6af1c637348714c2b5a6ca676 f8896b684e246f3f00f45ba2b6803ae59b9cc768 git Not specified
CNA Linux Linux affected a4d6cb7cf45bddc76c78ed5fd683328af9e2018f 30ff978af92cb51c9ba99f96fc4f4ac80d7001ba git Not specified
CNA Linux Linux affected 121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f c39f5765ad840b71ff8db812d0210f216cca96e4 git Not specified
CNA Linux Linux affected 9e36568e67f817c728f9d79049d212da79109a75 c973d53bcd420b58c4a34c68198746286d77e9fa git Not specified
CNA Linux Linux affected fb3f7ec2606cdc7c6ef30970f381e571866bfd54 c1fc0d3aff26ec9ff885b3e4c92eba98cf349678 git Not specified
CNA Linux Linux affected 509c2605065004fc4cd86ee50a9350d402785307 dd395744e4ed87956fcbf81ecc6a20c51e35fa4e git Not specified
CNA Linux Linux affected 2c85c61d1332e1e16f020d76951baf167dcb6f7a f7e8117e42b20c30d2a5edab82c944a5e381d791 git Not specified
CNA Linux Linux affected 2c85c61d1332e1e16f020d76951baf167dcb6f7a af1a9b65ebe8a948eda805c14b78d4d0767cb1b5 git Not specified
CNA Linux Linux affected 710a946b1aa2c35dc56f86621f436938f31ba1a5 git Not specified
CNA Linux Linux affected 5.10.259 5.10.261 semver Not specified
CNA Linux Linux affected 5.15.210 5.15.212 semver Not specified
CNA Linux Linux affected 6.1.176 6.1.178 semver Not specified
CNA Linux Linux affected 6.6.143 6.6.145 semver Not specified
CNA Linux Linux affected 6.12.93 6.12.97 semver Not specified
CNA Linux Linux affected 6.18.33 6.18.40 semver Not specified
CNA Linux Linux affected 7.0.10 7.1 semver Not specified
CNA Linux Linux affected 7.1 Not specified
CNA Linux Linux unaffected 7.1 semver Not specified
CNA Linux Linux unaffected 5.10.261 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.212 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.97 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/f8896b684e246f3f00f45ba2b6803ae59b9cc768 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f7e8117e42b20c30d2a5edab82c944a5e381d791 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c39f5765ad840b71ff8db812d0210f216cca96e4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/af1a9b65ebe8a948eda805c14b78d4d0767cb1b5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c1fc0d3aff26ec9ff885b3e4c92eba98cf349678 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/30ff978af92cb51c9ba99f96fc4f4ac80d7001ba 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c973d53bcd420b58c4a34c68198746286d77e9fa 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/dd395744e4ed87956fcbf81ecc6a20c51e35fa4e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report