CVE-2026-89621HID: mcp2221: validate report size in mcp2221_raw_event()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221_raw_event() mcp2221_raw_event() never validates the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3] as the copy length without checking that 4 + data[3] bytes actually exist in the received report. A malicious or misbehaving USB device can send a short report with a large data[3], causing the memcpy to read past the valid report data in the HID transfer buffer and leak uninitialized kernel memory back to userspace through the I2C/SMBus read path. Add a minimum size check at entry and validate that the source range fits within the received report before the copy.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 67a95c21463d066060b0f66d65a75d45bb386ffb before cb38b1f149b7143355b37e86c841acf0076e5c2a; from 67a95c21463d066060b0f66d65a75d45bb386ffb before b2c67dc0e30c308647bbd9b9e5d69a44c9d2733d; from 67a95c21463d066060b0f66d65a75d45bb386ffb before fffcfa367072628c3144cca17d2a3c3c9e50c057; from 67a95c21463d066060b0f66d65a75d45bb386ffb before c1c508e8923911cb458234997e55b7a4b9aa066f; from 67a95c21463d066060b0f66d65a75d45bb386ffb before bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149; from 67a95c21463d066060b0f66d65a75d45bb386ffb before 127de5919820f88a9d55e8371ad4ac49f625f4c5; 67a95c21463d066060b0f66d65a75d45bb386ffb builds before 7c18fb36708a97ff6772825cc087b6d537bbf0d5; 67a95c21463d066060b0f66d65a75d45bb386ffb builds before 2c9a6998c19503626c57a2267bf279e204113079 | CNA record |
References
- https://git.kernel.org/stable/c/cb38b1f149b7143355b37e86c841acf0076e5c2a
- https://git.kernel.org/stable/c/b2c67dc0e30c308647bbd9b9e5d69a44c9d2733d
- https://git.kernel.org/stable/c/fffcfa367072628c3144cca17d2a3c3c9e50c057
- https://git.kernel.org/stable/c/c1c508e8923911cb458234997e55b7a4b9aa066f
- https://git.kernel.org/stable/c/bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149
- https://git.kernel.org/stable/c/127de5919820f88a9d55e8371ad4ac49f625f4c5
- https://git.kernel.org/stable/c/7c18fb36708a97ff6772825cc087b6d537bbf0d5
- https://git.kernel.org/stable/c/2c9a6998c19503626c57a2267bf279e204113079
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.