CVE-2026-98860HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to size_t when compared against size. This causes the negative error code to evaluate as a large positive number, making the (ret > size) condition true. This silently converts the hardware error into a success return value and copies the unmodified buffer back, which could leave BPF programs operating on uninitialized or stale data. Fix this by casting size into ssize_t to return the actual negative error code.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from d6efaa50af62fb0790dd1fd4e7e5506b46312510 before 8b85ef0f561039e249c3f883c5280a1449c6dbee; from 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1 before 97be6396817bd3b11d06239010d27902940bfaa9; from 2b658c1c442ec1cd9eec5ead98d68662c40fe645 before f9f808227554b2c116fd07dd2328ecd74ea3f411; from 2b658c1c442ec1cd9eec5ead98d68662c40fe645 before 3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c; eb57dae20fdf6f3069cdc07821fa3bb46de381d7; from 6.12.78 before 6.12.113; from 6.18.20 before 6.18.56; from 6.19.10 before 6.20 | CNA record |
References
- https://git.kernel.org/stable/c/8b85ef0f561039e249c3f883c5280a1449c6dbee
- https://git.kernel.org/stable/c/97be6396817bd3b11d06239010d27902940bfaa9
- https://git.kernel.org/stable/c/f9f808227554b2c116fd07dd2328ecd74ea3f411
- https://git.kernel.org/stable/c/3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.