CVE-2026-23178

HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()

State: Published
Severity: 7.8 High
Published: Feb 14, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()

`i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data into `ihid->rawbuf`.

The former can come from the userspace in the hidraw driver and is only bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set `max_buffer_size` field of `struct hid_ll_driver` which we do not).

The latter has size determined at runtime by the maximum size of different report types you could receive on any particular device and can be a much smaller value.

Fix this by truncating `recv_len` to `ihid->bufsize - sizeof(__le16)`.

The impact is low since access to hidraw devices requires root.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-122 Heap-based Buffer Overflow

Affected Products

Product	Versions
LinuxLinux	85df713377ddc0482071c3e6b64c37bd1e48f1f1 to before f9c9ad89d845f88a1509e9d672f65d234425fde9Affected 85df713377ddc0482071c3e6b64c37bd1e48f1f1 to before cff3f619fd1cb40cdd89971df9001f075613d219Affected 85df713377ddc0482071c3e6b64c37bd1e48f1f1 to before 786ec171788bdf9dda38789163f1b1fbb47f2d1eAffected 85df713377ddc0482071c3e6b64c37bd1e48f1f1 to before 2124279f1f8c32c1646ce98e75a1a39b23b7db76Affected 85df713377ddc0482071c3e6b64c37bd1e48f1f1 to before 2497ff38c530b1af0df5130ca9f5ab22c5e92f29Affected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.163 through 6.1.Not affected 6.6.124 through 6.6.Not affected 6.12.70 through 6.12.Not affected 6.18.10 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

85df713377ddc0482071c3e6b64c37bd1e48f1f1 to before f9c9ad89d845f88a1509e9d672f65d234425fde9Affected
85df713377ddc0482071c3e6b64c37bd1e48f1f1 to before cff3f619fd1cb40cdd89971df9001f075613d219Affected
85df713377ddc0482071c3e6b64c37bd1e48f1f1 to before 786ec171788bdf9dda38789163f1b1fbb47f2d1eAffected
85df713377ddc0482071c3e6b64c37bd1e48f1f1 to before 2124279f1f8c32c1646ce98e75a1a39b23b7db76Affected
85df713377ddc0482071c3e6b64c37bd1e48f1f1 to before 2497ff38c530b1af0df5130ca9f5ab22c5e92f29Affected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.163 through 6.1.*Not affected
6.6.124 through 6.6.*Not affected
6.12.70 through 6.12.*Not affected
6.18.10 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.