CVE-2026-98860
Received
Received - Intake
HID BPF Hardware Request Error Handling Issue
Vulnerability report for CVE-2026-98860, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
As reported by Sashiko:
If a transport driver encounters a hardware error and returns a negative
error code such as -EPIPE, ret is implicitly promoted to size_t when
compared against size. This causes the negative error code to evaluate
as a large positive number, making the (ret > size) condition true.
This silently converts the hardware error into a success return value
and copies the unmodified buffer back, which could leave BPF programs
operating on uninitialized or stale data.
Fix this by casting size into ssize_t to return the actual negative
error code.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | d6efaa50af62fb0790dd1fd4e7e5506b46312510 |
| Linux | Linux | 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1 |
| Linux | Linux | 2b658c1c442ec1cd9eec5ead98d68662c40fe645 |
| Linux | Linux | 2b658c1c442ec1cd9eec5ead98d68662c40fe645 |
| Linux | Linux | eb57dae20fdf6f3069cdc07821fa3bb46de381d7 |
| Linux | Linux | 6.12.78 |
| Linux | Linux | 6.18.20 |
| Linux | Linux | 6.19.10 |
| Linux | Linux | 7.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
