CVE-2026-80604

Received Received - Intake

HID Core OOB Read in Linux Kernel

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-18

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80604

EUVD

EUVD-2026-67480

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in the Linux kernel's HID core subsystem. It occurs when a function called hid_report_raw_event() receives a size parameter of 0 for a numbered report. The function then calls hid_get_report() which tries to access data[0] without checking if the size is valid. Since the size is 0, this leads to reading outside the allocated memory, causing a kernel panic or other undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel and can be detected by checking the kernel version for affected releases. Use uname -a to view your kernel version and compare it against patched versions. Monitor kernel logs for crashes or OOB read warnings related to HID report handling.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a kernel panic or crash the system by providing malformed input. This may lead to denial-of-service conditions, system instability, or potential privilege escalation if combined with other exploits. Users might experience unexpected system reboots or crashes.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue involving an out-of-bounds read in the Linux kernel's HID subsystem. Compliance impacts would only occur if this vulnerability were exploited to gain unauthorized access or cause system instability, potentially affecting data integrity or availability.

Mitigation Strategies

Update the Linux kernel to the latest patched version immediately. If immediate patching is not possible, disable or restrict access to HID devices until the kernel is updated to prevent exploitation. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-80604. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70