CVE-2026-80604
Description
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.
How to fix
- Linux Linuxf8896b684e246f3f00f45ba2b6803ae59b9cc768, 30ff978af92cb51c9ba99f96fc4f4ac80d7001ba, c39f5765ad840b71ff8db812d0210f216cca96e4, c973d53bcd420b58c4a34c68198746286d77e9fa, c1fc0d3aff26ec9ff885b3e4c92eba98cf349678, dd395744e4ed87956fcbf81ecc6a20c51e35fa4e, f7e8117e42b20c30d2a5edab82c944a5e381d791, af1a9b65ebe8a948eda805c14b78d4d0767cb1b5, 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 59bfdb41a34cf5d6af1c637348714c2b5a6ca676 ≤ v < f8896b684e246f3f00f45ba2b6803ae59b9cc768, a4d6cb7cf45bddc76c78ed5fd683328af9e2018f ≤ v < 30ff978af92cb51c9ba99f96fc4f4ac80d7001ba, 121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f ≤ v < c39f5765ad840b71ff8db812d0210f216cca96e4, 9e36568e67f817c728f9d79049d212da79109a75 ≤ v < c973d53bcd420b58c4a34c68198746286d77e9fa, fb3f7ec2606cdc7c6ef30970f381e571866bfd54 ≤ v < c1fc0d3aff26ec9ff885b3e4c92eba98cf349678, 509c2605065004fc4cd86ee50a9350d402785307 ≤ v < dd395744e4ed87956fcbf81ecc6a20c51e35fa4e, 2c85c61d1332e1e16f020d76951baf167dcb6f7a ≤ v < f7e8117e42b20c30d2a5edab82c944a5e381d791, 2c85c61d1332e1e16f020d76951baf167dcb6f7a ≤ v < af1a9b65ebe8a948eda805c14b78d4d0767cb1b5, 710a946b1aa2c35dc56f86621f436938f31ba1a5, 5.10.259 ≤ v < 5.10.261, 5.15.210 ≤ v < 5.15.212, 6.1.176 ≤ v < 6.1.178, 6.6.143 ≤ v < 6.6.145, 6.12.93 ≤ v < 6.12.97, 6.18.33 ≤ v < 6.18.40, 7.0.10 ≤ v < 7.1, 7.1 | f8896b684e246f3f00f45ba2b6803ae59b9cc768, 30ff978af92cb51c9ba99f96fc4f4ac80d7001ba, c39f5765ad840b71ff8db812d0210f216cca96e4, c973d53bcd420b58c4a34c68198746286d77e9fa, c1fc0d3aff26ec9ff885b3e4c92eba98cf349678, dd395744e4ed87956fcbf81ecc6a20c51e35fa4e, f7e8117e42b20c30d2a5edab82c944a5e381d791, af1a9b65ebe8a948eda805c14b78d4d0767cb1b5, 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.