CVE-2026-89729

Received Received - Intake

Out-of-Bounds Write in Linux Kernel HID Sensor Hub

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write. HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89729

EUVD

EUVD-2026-76641

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds write flaw in the Linux kernel's HID sensor-hub driver. The function sensor_hub_get_feature() incorrectly copies data based on a malicious HID descriptor's large feature field size while the caller provides a small buffer. This causes the function to write beyond the allocated buffer memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID sensor-hub driver and requires kernel-level inspection. Check kernel logs for HID-related errors or crashes using 'dmesg | grep -i hid' or 'journalctl -k | grep -i hid'. Review HID device descriptors for unusually large feature field sizes.

Impact Analysis

This vulnerability could allow an attacker with access to craft malicious HID input to corrupt kernel memory. This may lead to system crashes, privilege escalation, or arbitrary code execution, potentially compromising the entire system.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-89729. If immediate patching is not possible, consider disabling affected HID sensor devices or restricting access to untrusted HID devices.

Hi! I’m here to help you understand CVE-2026-89729. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70