{"api_version":"1","generated_at":"2026-10-27T14:38:23+00:00","cve":"CVE-2026-72352","urls":{"html":"https://cve.report/CVE-2026-72352","api":"https://cve.report/api/cve/CVE-2026-72352.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72352","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72352"},"summary":{"title":"HID: bpf: Fix hid_bpf_get_data() range check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: Fix hid_bpf_get_data() range check\n\nhid_bpf_get_data() returns a pointer into the HID-BPF context data when\nthe caller-provided offset and size fit inside ctx->allocated_size.\n\nThe current check adds rdwr_buf_size and offset before comparing the\nresult against ctx->allocated_size. Since both values are unsigned, a\nvery large size can wrap the sum below ctx->allocated_size and make the\nhelper return a pointer even though the requested range is not contained\nin the backing buffer.\n\nUse check_add_overflow() to reject wrapped range ends before comparing\nthe requested range end against ctx->allocated_size.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:08","updated_at":"2026-10-21 13:19:35"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/2d044049421dd48212b28646a850749d4a2d57fa","name":"https://git.kernel.org/stable/c/2d044049421dd48212b28646a850749d4a2d57fa","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/61a959b82f1aecd6d2d35c208013dd077cac9d10","name":"https://git.kernel.org/stable/c/61a959b82f1aecd6d2d35c208013dd077cac9d10","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f72176bde0cc0e709e41ab170c71e8f229232af6","name":"https://git.kernel.org/stable/c/f72176bde0cc0e709e41ab170c71e8f229232af6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f","name":"https://git.kernel.org/stable/c/f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ca373549140dfb386aa2de38364b58441b1f4885","name":"https://git.kernel.org/stable/c/ca373549140dfb386aa2de38364b58441b1f4885","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72352","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72352","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 658ee5a64fcfbbf758447fa3af425729eaabb0dc f72176bde0cc0e709e41ab170c71e8f229232af6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 658ee5a64fcfbbf758447fa3af425729eaabb0dc ca373549140dfb386aa2de38364b58441b1f4885 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 658ee5a64fcfbbf758447fa3af425729eaabb0dc 61a959b82f1aecd6d2d35c208013dd077cac9d10 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 658ee5a64fcfbbf758447fa3af425729eaabb0dc f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 658ee5a64fcfbbf758447fa3af425729eaabb0dc 2d044049421dd48212b28646a850749d4a2d57fa git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.3","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.97 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72352","cve":"CVE-2026-72352","epss":"0.001750000","percentile":"0.065510000","score_date":"2026-10-16","updated_at":"2026-10-17 00:14:16"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-72352","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T18:47:53.495070Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-16T18:55:20.122Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/bpf/hid_bpf_dispatch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f72176bde0cc0e709e41ab170c71e8f229232af6","status":"affected","version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","versionType":"git"},{"lessThan":"ca373549140dfb386aa2de38364b58441b1f4885","status":"affected","version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","versionType":"git"},{"lessThan":"61a959b82f1aecd6d2d35c208013dd077cac9d10","status":"affected","version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","versionType":"git"},{"lessThan":"f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f","status":"affected","version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","versionType":"git"},{"lessThan":"2d044049421dd48212b28646a850749d4a2d57fa","status":"affected","version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/bpf/hid_bpf_dispatch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.3"},{"lessThan":"6.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.97","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: Fix hid_bpf_get_data() range check\n\nhid_bpf_get_data() returns a pointer into the HID-BPF context data when\nthe caller-provided offset and size fit inside ctx->allocated_size.\n\nThe current check adds rdwr_buf_size and offset before comparing the\nresult against ctx->allocated_size. Since both values are unsigned, a\nvery large size can wrap the sum below ctx->allocated_size and make the\nhelper return a pointer even though the requested range is not contained\nin the backing buffer.\n\nUse check_add_overflow() to reject wrapped range ends before comparing\nthe requested range end against ctx->allocated_size."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is only reachable through local bpf() syscalls that load BPF_PROG_TYPE_STRUCT_OPS HID-BPF programs and attach them via BPF_LINK_CREATE; per kernel CNA guidance BPF subsystem bugs are Local even though callbacks may later run on HID input.\nAC:L - Once a HID-BPF program is loaded, the attacker fully controls offset and rdwr_buf_size passed to hid_bpf_get_data(); values such as offset=2 with size=~0 reliably wrap the unsigned sum and bypass the check without races or uncontrollable memory layout.\nPR:L - Loading BPF_MAP_TYPE_STRUCT_OPS maps and BPF_PROG_TYPE_STRUCT_OPS programs requires CAP_BPF (sysctl_unprivileged_bpf_disabled blocks unprivileged BPF); per kernel CNA guidance this is Low because CAP_BPF can be delegated via BPF tokens into user namespaces, not only init-namespace root.\nUI:N - The attacker loads and attaches their own HID-BPF program and triggers hid_bpf_get_data() from its callbacks; no separate victim action such as mounting, opening a file, or plugging in a device is required beyond the attacker's own bpf operations.\nS:U - Exploitation corrupts kernel heap memory from within the same kernel security authority to achieve local privilege escalation; it does not inherently cross VM, IOMMU, or container sandbox boundaries as a distinct scope change.\nC:H - The overflow lets BPF code obtain a pointer outside the allocated HID-BPF context buffer and read adjacent kernel heap memory, enabling arbitrary kernel information disclosure and supporting further exploitation primitives.\nI:H - The same out-of-bounds pointer allows arbitrary kernel heap writes through the returned buffer, enabling control of adjacent objects and potential arbitrary code execution in kernel context.\nA:H - Large out-of-bounds reads/writes against kmalloc-backed HID-BPF buffers can corrupt critical kernel structures and cause kernel oops, panic, or hang during HID-BPF callback execution."}]}],"providerMetadata":{"dateUpdated":"2026-10-21T12:44:39.607Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f72176bde0cc0e709e41ab170c71e8f229232af6"},{"url":"https://git.kernel.org/stable/c/ca373549140dfb386aa2de38364b58441b1f4885"},{"url":"https://git.kernel.org/stable/c/61a959b82f1aecd6d2d35c208013dd077cac9d10"},{"url":"https://git.kernel.org/stable/c/f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f"},{"url":"https://git.kernel.org/stable/c/2d044049421dd48212b28646a850749d4a2d57fa"}],"title":"HID: bpf: Fix hid_bpf_get_data() range check","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72352","datePublished":"2026-08-15T05:55:54.809Z","dateReserved":"2026-08-09T03:40:39.921Z","dateUpdated":"2026-10-21T12:44:39.607Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:08","lastModifiedDate":"2026-10-21 13:19:35","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T18:47:53.495070Z","id":"CVE-2026-72352","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72352","Ordinal":"1","Title":"HID: bpf: Fix hid_bpf_get_data() range check","CVE":"CVE-2026-72352","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72352","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: Fix hid_bpf_get_data() range check\n\nhid_bpf_get_data() returns a pointer into the HID-BPF context data when\nthe caller-provided offset and size fit inside ctx->allocated_size.\n\nThe current check adds rdwr_buf_size and offset before comparing the\nresult against ctx->allocated_size. Since both values are unsigned, a\nvery large size can wrap the sum below ctx->allocated_size and make the\nhelper return a pointer even though the requested range is not contained\nin the backing buffer.\n\nUse check_add_overflow() to reject wrapped range ends before comparing\nthe requested range end against ctx->allocated_size.","Type":"Description","Title":"HID: bpf: Fix hid_bpf_get_data() range check"}]}}}