CVE-2026-80604HID: core: Fix OOB read in hid_get_report for numbered reports
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 59bfdb41a34cf5d6af1c637348714c2b5a6ca676 before f8896b684e246f3f00f45ba2b6803ae59b9cc768; from a4d6cb7cf45bddc76c78ed5fd683328af9e2018f before 30ff978af92cb51c9ba99f96fc4f4ac80d7001ba; from 121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f before c39f5765ad840b71ff8db812d0210f216cca96e4; from 9e36568e67f817c728f9d79049d212da79109a75 before c973d53bcd420b58c4a34c68198746286d77e9fa; from fb3f7ec2606cdc7c6ef30970f381e571866bfd54 before c1fc0d3aff26ec9ff885b3e4c92eba98cf349678; from 509c2605065004fc4cd86ee50a9350d402785307 before dd395744e4ed87956fcbf81ecc6a20c51e35fa4e; from 2c85c61d1332e1e16f020d76951baf167dcb6f7a before f7e8117e42b20c30d2a5edab82c944a5e381d791; from 2c85c61d1332e1e16f020d76951baf167dcb6f7a before af1a9b65ebe8a948eda805c14b78d4d0767cb1b5; and 8 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/f8896b684e246f3f00f45ba2b6803ae59b9cc768
- https://git.kernel.org/stable/c/30ff978af92cb51c9ba99f96fc4f4ac80d7001ba
- https://git.kernel.org/stable/c/c39f5765ad840b71ff8db812d0210f216cca96e4
- https://git.kernel.org/stable/c/c973d53bcd420b58c4a34c68198746286d77e9fa
- https://git.kernel.org/stable/c/c1fc0d3aff26ec9ff885b3e4c92eba98cf349678
- https://git.kernel.org/stable/c/dd395744e4ed87956fcbf81ecc6a20c51e35fa4e
- https://git.kernel.org/stable/c/f7e8117e42b20c30d2a5edab82c944a5e381d791
- https://git.kernel.org/stable/c/af1a9b65ebe8a948eda805c14b78d4d0767cb1b5
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.