8.8

CVE-2026-80604

HID: core: Fix OOB read in hid_get_report for numbered reports

In the Linux kernel, the following vulnerability has been resolved:

HID: core: Fix OOB read in hid_get_report for numbered reports

When a caller passes a size of 0 to hid_report_raw_event() for a
numbered report, the function originally called hid_get_report() before
performing any size validation.

Inside hid_get_report(), if the report is numbered (report_enum->numbered
is true), it unconditionally dereferences data[0] to extract the report ID.
With a size of 0, this results in an out-of-bounds read or kernel panic.

Fix this by moving the numbered report size validation check before the
call to hid_get_report(), ensuring that size is at least 1 before
dereferencing the data pointer.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 59bfdb41a34cf5d6af1c637348714c2b5a6ca676
Version < f8896b684e246f3f00f45ba2b6803ae59b9cc768
Status affected
Version a4d6cb7cf45bddc76c78ed5fd683328af9e2018f
Version < 30ff978af92cb51c9ba99f96fc4f4ac80d7001ba
Status affected
Version 121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f
Version < c39f5765ad840b71ff8db812d0210f216cca96e4
Status affected
Version 9e36568e67f817c728f9d79049d212da79109a75
Version < c973d53bcd420b58c4a34c68198746286d77e9fa
Status affected
Version fb3f7ec2606cdc7c6ef30970f381e571866bfd54
Version < c1fc0d3aff26ec9ff885b3e4c92eba98cf349678
Status affected
Version 509c2605065004fc4cd86ee50a9350d402785307
Version < dd395744e4ed87956fcbf81ecc6a20c51e35fa4e
Status affected
Version 2c85c61d1332e1e16f020d76951baf167dcb6f7a
Version < f7e8117e42b20c30d2a5edab82c944a5e381d791
Status affected
Version 2c85c61d1332e1e16f020d76951baf167dcb6f7a
Version < af1a9b65ebe8a948eda805c14b78d4d0767cb1b5
Status affected
Version 710a946b1aa2c35dc56f86621f436938f31ba1a5
Status affected
Version 5.10.259
Version < 5.10.261
Status affected
Version 5.15.210
Version < 5.15.212
Status affected
Version 6.1.176
Version < 6.1.178
Status affected
Version 6.6.143
Version < 6.6.145
Status affected
Version 6.12.93
Version < 6.12.97
Status affected
Version 6.18.33
Version < 6.18.40
Status affected
Version 7.0.10
Version < 7.1
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 7.1
Status affected
Version 0
Version < 7.1
Status unaffected
Version <= 5.10.*
Version 5.10.261
Status unaffected
Version <= 5.15.*
Version 5.15.212
Status unaffected
Version <= 6.1.*
Version 6.1.178
Status unaffected
Version <= 6.6.*
Version 6.6.145
Status unaffected
Version <= 6.12.*
Version 6.12.97
Status unaffected
Version <= 6.18.*
Version 6.18.40
Status unaffected
Version <= 7.1.*
Version 7.1.5
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.181
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/f8896b684e246f3f00f45ba2b6803ae59b9cc768
https://git.kernel.org/stable/c/30ff978af92cb51c9ba99f96fc4f4ac80d7001ba
https://git.kernel.org/stable/c/c39f5765ad840b71ff8db812d0210f216cca96e4
https://git.kernel.org/stable/c/c973d53bcd420b58c4a34c68198746286d77e9fa
https://git.kernel.org/stable/c/c1fc0d3aff26ec9ff885b3e4c92eba98cf349678
https://git.kernel.org/stable/c/dd395744e4ed87956fcbf81ecc6a20c51e35fa4e
https://git.kernel.org/stable/c/f7e8117e42b20c30d2a5edab82c944a5e381d791
https://git.kernel.org/stable/c/af1a9b65ebe8a948eda805c14b78d4d0767cb1b5