CVE-2026-89621

HID: mcp2221: validate report size in mcp2221_raw_event()

State: Published
Severity: Not scored
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: mcp2221: validate report size in mcp2221_raw_event()

mcp2221_raw_event() never validates the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3] as the copy length without checking that 4 + data[3] bytes actually exist in the received report. A malicious or misbehaving USB device can send a short report with a large data[3], causing the memcpy to read past the valid report data in the HID transfer buffer and leak uninitialized kernel memory back to userspace through the I2C/SMBus read path.

Add a minimum size check at entry and validate that the source range fits within the received report before the copy.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	67a95c21463d066060b0f66d65a75d45bb386ffb to before cb38b1f149b7143355b37e86c841acf0076e5c2aAffected 67a95c21463d066060b0f66d65a75d45bb386ffb to before b2c67dc0e30c308647bbd9b9e5d69a44c9d2733dAffected 67a95c21463d066060b0f66d65a75d45bb386ffb to before fffcfa367072628c3144cca17d2a3c3c9e50c057Affected 67a95c21463d066060b0f66d65a75d45bb386ffb to before c1c508e8923911cb458234997e55b7a4b9aa066fAffected 67a95c21463d066060b0f66d65a75d45bb386ffb to before bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149Affected 67a95c21463d066060b0f66d65a75d45bb386ffb to before 127de5919820f88a9d55e8371ad4ac49f625f4c5Affected 67a95c21463d066060b0f66d65a75d45bb386ffb to before 7c18fb36708a97ff6772825cc087b6d537bbf0d5Affected 67a95c21463d066060b0f66d65a75d45bb386ffb to before 2c9a6998c19503626c57a2267bf279e204113079Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

67a95c21463d066060b0f66d65a75d45bb386ffb to before cb38b1f149b7143355b37e86c841acf0076e5c2aAffected
67a95c21463d066060b0f66d65a75d45bb386ffb to before b2c67dc0e30c308647bbd9b9e5d69a44c9d2733dAffected
67a95c21463d066060b0f66d65a75d45bb386ffb to before fffcfa367072628c3144cca17d2a3c3c9e50c057Affected
67a95c21463d066060b0f66d65a75d45bb386ffb to before c1c508e8923911cb458234997e55b7a4b9aa066fAffected
67a95c21463d066060b0f66d65a75d45bb386ffb to before bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149Affected
67a95c21463d066060b0f66d65a75d45bb386ffb to before 127de5919820f88a9d55e8371ad4ac49f625f4c5Affected
67a95c21463d066060b0f66d65a75d45bb386ffb to before 7c18fb36708a97ff6772825cc087b6d537bbf0d5Affected
67a95c21463d066060b0f66d65a75d45bb386ffb to before 2c9a6998c19503626c57a2267bf279e204113079Affected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.