CVE-2026-89619HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer quickspi_hid_raw_request() receives the caller's buffer length in len, but quickspi_get_report() never sees it and copies the whole device-supplied response into buf regardless: memcpy(buf, qsdev->report_buf, qsdev->report_len); qsdev->report_len comes from the input report the touch controller returns, while buf is sized to whatever the caller asked hidraw for through HIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf with device-controlled content. The intel-quicki2c sibling already passes the caller length down to quicki2c_get_report() and validates the response against it before the copy. Do the same here.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4138f21115aec3ebae7805ec3407c72d93558023 before 72706b44b665679d7d60a488d8776a911f1a93f3; 4138f21115aec3ebae7805ec3407c72d93558023 builds before 54e0bafc0653bdf2a6c5f5f8ad8787a820d98663; 4138f21115aec3ebae7805ec3407c72d93558023 builds before 035ec4a71cb8020a927c123bbe75c2f88d614986 | CNA record |
References
- https://git.kernel.org/stable/c/72706b44b665679d7d60a488d8776a911f1a93f3
- https://git.kernel.org/stable/c/54e0bafc0653bdf2a6c5f5f8ad8787a820d98663
- https://git.kernel.org/stable/c/035ec4a71cb8020a927c123bbe75c2f88d614986
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.