CVE-2026-64367

Awaiting Analysis Awaiting Analysis - Queue

Stack Buffer Overflow in Linux Kernel HID Goodix SPI Driver

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack buffer (tmp_buf), writing an 11-12 byte header followed by the caller-supplied report data. The HID core caps report size at HID_MAX_BUFFER_SIZE (16384) by default, while the driver does not set hid_ll_driver.max_buffer_size and performs no bounds checking before copying the payload: memcpy(tmp_buf + tx_len, buf, len); A hidraw SET_REPORT ioctl with a report larger than ~116 bytes overflows the stack buffer. Add a size check after constructing the header, rejecting reports that would exceed the buffer capacity. Discovered by Atuin - Automated Vulnerability Discovery Engine.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64367

EUVD

EUVD-2026-48911

Affected Vendors & Products

Vendor	Product	Version / Range
goodix	hid-goodix-spi	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a stack buffer overflow in the Linux kernel's HID driver for Goodix SPI devices. The issue occurs in the goodix_hid_set_raw_report function, which uses a fixed 128-byte stack buffer to build protocol frames. The function does not validate the size of user-supplied report data before copying it into the buffer, allowing an overflow if the report exceeds approximately 116 bytes.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID subsystem, particularly the hid-goodix-spi driver. Detection requires checking for stack buffer overflows in the driver's report handling. Monitor kernel logs for stack overflow warnings or crashes. Use commands like 'dmesg | grep -i stack' or 'journalctl -k | grep -i overflow' to detect anomalies. Ensure the driver version is up to date and check for unusual hidraw SET_REPORT ioctl calls with large payloads.

No direct network detection commands are applicable as this is a local kernel-level issue. Focus on system logs and driver behavior.

Impact Analysis

An attacker with access to the system could exploit this flaw to cause a denial of service or execute arbitrary code with kernel privileges. This could lead to system crashes, unauthorized access, or further compromise of the affected device.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level stack buffer overflow in a Linux kernel driver (hid-goodix-spi). However, if exploited, it could lead to arbitrary code execution or system crashes, potentially compromising data integrity or availability. Such compromises might indirectly impact compliance if they result in unauthorized data access or service disruptions.

Mitigation Strategies

Apply the latest kernel updates that include the fix for this vulnerability. If using a custom kernel, backport the patch that adds bounds checking in goodix_hid_set_raw_report(). Disable the hid-goodix-spi driver if not in use. Restrict access to hidraw devices to prevent unauthorized SET_REPORT ioctl calls. Monitor vendor advisories for driver updates.

Hi! I’m here to help you understand CVE-2026-64367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70