CVE-2026-72352
Description
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hid_bpf_get_data() range check hid_bpf_get_data() returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx->allocated_size. The current check adds rdwr_buf_size and offset before comparing the result against ctx->allocated_size. Since both values are unsigned, a very large size can wrap the sum below ctx->allocated_size and make the helper return a pointer even though the requested range is not contained in the backing buffer. Use check_add_overflow() to reject wrapped range ends before comparing the requested range end against ctx->allocated_size.
How to fix
- Linux Linuxf72176bde0cc0e709e41ab170c71e8f229232af6, ca373549140dfb386aa2de38364b58441b1f4885, 61a959b82f1aecd6d2d35c208013dd077cac9d10, f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f, 2d044049421dd48212b28646a850749d4a2d57fa or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 658ee5a64fcfbbf758447fa3af425729eaabb0dc ≤ v < f72176bde0cc0e709e41ab170c71e8f229232af6, 658ee5a64fcfbbf758447fa3af425729eaabb0dc ≤ v < ca373549140dfb386aa2de38364b58441b1f4885, 658ee5a64fcfbbf758447fa3af425729eaabb0dc ≤ v < 61a959b82f1aecd6d2d35c208013dd077cac9d10, 658ee5a64fcfbbf758447fa3af425729eaabb0dc ≤ v < f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f, 658ee5a64fcfbbf758447fa3af425729eaabb0dc ≤ v < 2d044049421dd48212b28646a850749d4a2d57fa, 6.3 | f72176bde0cc0e709e41ab170c71e8f229232af6, ca373549140dfb386aa2de38364b58441b1f4885, 61a959b82f1aecd6d2d35c208013dd077cac9d10, f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f, 2d044049421dd48212b28646a850749d4a2d57fa |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.