{"api_version":"1","generated_at":"2026-08-28T16:59:05+00:00","cve":"CVE-2026-80604","urls":{"html":"https://cve.report/CVE-2026-80604","api":"https://cve.report/api/cve/CVE-2026-80604.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-80604","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-80604"},"summary":{"title":"HID: core: Fix OOB read in hid_get_report for numbered reports","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Fix OOB read in hid_get_report for numbered reports\n\nWhen a caller passes a size of 0 to hid_report_raw_event() for a\nnumbered report, the function originally called hid_get_report() before\nperforming any size validation.\n\nInside hid_get_report(), if the report is numbered (report_enum->numbered\nis true), it unconditionally dereferences data[0] to extract the report ID.\nWith a size of 0, this results in an out-of-bounds read or kernel panic.\n\nFix this by moving the numbered report size validation check before the\ncall to hid_get_report(), ensuring that size is at least 1 before\ndereferencing the data pointer.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-28 08:16:44","updated_at":"2026-08-28 08:16:44"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/f8896b684e246f3f00f45ba2b6803ae59b9cc768","name":"https://git.kernel.org/stable/c/f8896b684e246f3f00f45ba2b6803ae59b9cc768","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f7e8117e42b20c30d2a5edab82c944a5e381d791","name":"https://git.kernel.org/stable/c/f7e8117e42b20c30d2a5edab82c944a5e381d791","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c39f5765ad840b71ff8db812d0210f216cca96e4","name":"https://git.kernel.org/stable/c/c39f5765ad840b71ff8db812d0210f216cca96e4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/af1a9b65ebe8a948eda805c14b78d4d0767cb1b5","name":"https://git.kernel.org/stable/c/af1a9b65ebe8a948eda805c14b78d4d0767cb1b5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c1fc0d3aff26ec9ff885b3e4c92eba98cf349678","name":"https://git.kernel.org/stable/c/c1fc0d3aff26ec9ff885b3e4c92eba98cf349678","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/30ff978af92cb51c9ba99f96fc4f4ac80d7001ba","name":"https://git.kernel.org/stable/c/30ff978af92cb51c9ba99f96fc4f4ac80d7001ba","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c973d53bcd420b58c4a34c68198746286d77e9fa","name":"https://git.kernel.org/stable/c/c973d53bcd420b58c4a34c68198746286d77e9fa","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/dd395744e4ed87956fcbf81ecc6a20c51e35fa4e","name":"https://git.kernel.org/stable/c/dd395744e4ed87956fcbf81ecc6a20c51e35fa4e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80604","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80604","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59bfdb41a34cf5d6af1c637348714c2b5a6ca676 f8896b684e246f3f00f45ba2b6803ae59b9cc768 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a4d6cb7cf45bddc76c78ed5fd683328af9e2018f 30ff978af92cb51c9ba99f96fc4f4ac80d7001ba git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f c39f5765ad840b71ff8db812d0210f216cca96e4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9e36568e67f817c728f9d79049d212da79109a75 c973d53bcd420b58c4a34c68198746286d77e9fa git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fb3f7ec2606cdc7c6ef30970f381e571866bfd54 c1fc0d3aff26ec9ff885b3e4c92eba98cf349678 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 509c2605065004fc4cd86ee50a9350d402785307 dd395744e4ed87956fcbf81ecc6a20c51e35fa4e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2c85c61d1332e1e16f020d76951baf167dcb6f7a f7e8117e42b20c30d2a5edab82c944a5e381d791 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2c85c61d1332e1e16f020d76951baf167dcb6f7a af1a9b65ebe8a948eda805c14b78d4d0767cb1b5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 710a946b1aa2c35dc56f86621f436938f31ba1a5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.10.259 5.10.261 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.210 5.15.212 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.176 6.1.178 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6.143 6.6.145 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.93 6.12.97 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18.33 6.18.40 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.0.10 7.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.261 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.212 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.178 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.145 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.97 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f8896b684e246f3f00f45ba2b6803ae59b9cc768","status":"affected","version":"59bfdb41a34cf5d6af1c637348714c2b5a6ca676","versionType":"git"},{"lessThan":"30ff978af92cb51c9ba99f96fc4f4ac80d7001ba","status":"affected","version":"a4d6cb7cf45bddc76c78ed5fd683328af9e2018f","versionType":"git"},{"lessThan":"c39f5765ad840b71ff8db812d0210f216cca96e4","status":"affected","version":"121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f","versionType":"git"},{"lessThan":"c973d53bcd420b58c4a34c68198746286d77e9fa","status":"affected","version":"9e36568e67f817c728f9d79049d212da79109a75","versionType":"git"},{"lessThan":"c1fc0d3aff26ec9ff885b3e4c92eba98cf349678","status":"affected","version":"fb3f7ec2606cdc7c6ef30970f381e571866bfd54","versionType":"git"},{"lessThan":"dd395744e4ed87956fcbf81ecc6a20c51e35fa4e","status":"affected","version":"509c2605065004fc4cd86ee50a9350d402785307","versionType":"git"},{"lessThan":"f7e8117e42b20c30d2a5edab82c944a5e381d791","status":"affected","version":"2c85c61d1332e1e16f020d76951baf167dcb6f7a","versionType":"git"},{"lessThan":"af1a9b65ebe8a948eda805c14b78d4d0767cb1b5","status":"affected","version":"2c85c61d1332e1e16f020d76951baf167dcb6f7a","versionType":"git"},{"status":"affected","version":"710a946b1aa2c35dc56f86621f436938f31ba1a5","versionType":"git"},{"lessThan":"5.10.261","status":"affected","version":"5.10.259","versionType":"semver"},{"lessThan":"5.15.212","status":"affected","version":"5.15.210","versionType":"semver"},{"lessThan":"6.1.178","status":"affected","version":"6.1.176","versionType":"semver"},{"lessThan":"6.6.145","status":"affected","version":"6.6.143","versionType":"semver"},{"lessThan":"6.12.97","status":"affected","version":"6.12.93","versionType":"semver"},{"lessThan":"6.18.40","status":"affected","version":"6.18.33","versionType":"semver"},{"lessThan":"7.1","status":"affected","version":"7.0.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.261","versionStartIncluding":"5.10.259","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.212","versionStartIncluding":"5.15.210","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.178","versionStartIncluding":"6.1.176","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.145","versionStartIncluding":"6.6.143","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.97","versionStartIncluding":"6.12.93","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"6.18.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Fix OOB read in hid_get_report for numbered reports\n\nWhen a caller passes a size of 0 to hid_report_raw_event() for a\nnumbered report, the function originally called hid_get_report() before\nperforming any size validation.\n\nInside hid_get_report(), if the report is numbered (report_enum->numbered\nis true), it unconditionally dereferences data[0] to extract the report ID.\nWith a size of 0, this results in an out-of-bounds read or kernel panic.\n\nFix this by moving the numbered report size validation check before the\ncall to hid_get_report(), ensuring that size is at least 1 before\ndereferencing the data pointer."}],"providerMetadata":{"dateUpdated":"2026-08-28T06:48:29.755Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f8896b684e246f3f00f45ba2b6803ae59b9cc768"},{"url":"https://git.kernel.org/stable/c/30ff978af92cb51c9ba99f96fc4f4ac80d7001ba"},{"url":"https://git.kernel.org/stable/c/c39f5765ad840b71ff8db812d0210f216cca96e4"},{"url":"https://git.kernel.org/stable/c/c973d53bcd420b58c4a34c68198746286d77e9fa"},{"url":"https://git.kernel.org/stable/c/c1fc0d3aff26ec9ff885b3e4c92eba98cf349678"},{"url":"https://git.kernel.org/stable/c/dd395744e4ed87956fcbf81ecc6a20c51e35fa4e"},{"url":"https://git.kernel.org/stable/c/f7e8117e42b20c30d2a5edab82c944a5e381d791"},{"url":"https://git.kernel.org/stable/c/af1a9b65ebe8a948eda805c14b78d4d0767cb1b5"}],"title":"HID: core: Fix OOB read in hid_get_report for numbered reports","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-80604","datePublished":"2026-08-28T06:48:29.755Z","dateReserved":"2026-08-26T14:34:25.772Z","dateUpdated":"2026-08-28T06:48:29.755Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-28 08:16:44","lastModifiedDate":"2026-08-28 08:16:44","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"80604","Ordinal":"1","Title":"HID: core: Fix OOB read in hid_get_report for numbered reports","CVE":"CVE-2026-80604","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"80604","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Fix OOB read in hid_get_report for numbered reports\n\nWhen a caller passes a size of 0 to hid_report_raw_event() for a\nnumbered report, the function originally called hid_get_report() before\nperforming any size validation.\n\nInside hid_get_report(), if the report is numbered (report_enum->numbered\nis true), it unconditionally dereferences data[0] to extract the report ID.\nWith a size of 0, this results in an out-of-bounds read or kernel panic.\n\nFix this by moving the numbered report size validation check before the\ncall to hid_get_report(), ensuring that size is at least 1 before\ndereferencing the data pointer.","Type":"Description","Title":"HID: core: Fix OOB read in hid_get_report for numbered reports"}]}}}