CVE-2026-80604

HID: core: Fix OOB read in hid_get_report for numbered reports

State: Published
Severity: 8.8 High
Published: Aug 28, 2026
Updated: Oct 16, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: Fix OOB read in hid_get_report for numbered reports

When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation.

Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic.

Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	59bfdb41a34cf5d6af1c637348714c2b5a6ca676 to before f8896b684e246f3f00f45ba2b6803ae59b9cc768Affected a4d6cb7cf45bddc76c78ed5fd683328af9e2018f to before 30ff978af92cb51c9ba99f96fc4f4ac80d7001baAffected 121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f to before c39f5765ad840b71ff8db812d0210f216cca96e4Affected 9e36568e67f817c728f9d79049d212da79109a75 to before c973d53bcd420b58c4a34c68198746286d77e9faAffected fb3f7ec2606cdc7c6ef30970f381e571866bfd54 to before c1fc0d3aff26ec9ff885b3e4c92eba98cf349678Affected 509c2605065004fc4cd86ee50a9350d402785307 to before dd395744e4ed87956fcbf81ecc6a20c51e35fa4eAffected 2c85c61d1332e1e16f020d76951baf167dcb6f7a to before f7e8117e42b20c30d2a5edab82c944a5e381d791Affected 2c85c61d1332e1e16f020d76951baf167dcb6f7a to before af1a9b65ebe8a948eda805c14b78d4d0767cb1b5Affected 710a946b1aa2c35dc56f86621f436938f31ba1a5Affected 5.10.259 to before 5.10.261Affected 5.15.210 to before 5.15.212Affected 6.1.176 to before 6.1.178Affected 6.6.143 to before 6.6.145Affected 6.12.93 to before 6.12.97Affected 6.18.33 to before 6.18.40Affected 7.0.10 to before 7.1Affected
LinuxLinux	7.1Affected before 7.1Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

59bfdb41a34cf5d6af1c637348714c2b5a6ca676 to before f8896b684e246f3f00f45ba2b6803ae59b9cc768Affected
a4d6cb7cf45bddc76c78ed5fd683328af9e2018f to before 30ff978af92cb51c9ba99f96fc4f4ac80d7001baAffected
121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f to before c39f5765ad840b71ff8db812d0210f216cca96e4Affected
9e36568e67f817c728f9d79049d212da79109a75 to before c973d53bcd420b58c4a34c68198746286d77e9faAffected
fb3f7ec2606cdc7c6ef30970f381e571866bfd54 to before c1fc0d3aff26ec9ff885b3e4c92eba98cf349678Affected
509c2605065004fc4cd86ee50a9350d402785307 to before dd395744e4ed87956fcbf81ecc6a20c51e35fa4eAffected
2c85c61d1332e1e16f020d76951baf167dcb6f7a to before f7e8117e42b20c30d2a5edab82c944a5e381d791Affected
2c85c61d1332e1e16f020d76951baf167dcb6f7a to before af1a9b65ebe8a948eda805c14b78d4d0767cb1b5Affected
710a946b1aa2c35dc56f86621f436938f31ba1a5Affected
5.10.259 to before 5.10.261Affected
5.15.210 to before 5.15.212Affected
6.1.176 to before 6.1.178Affected
6.6.143 to before 6.6.145Affected
6.12.93 to before 6.12.97Affected
6.18.33 to before 6.18.40Affected
7.0.10 to before 7.1Affected

LinuxLinux

7.1Affected
before 7.1Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.