Description

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T08:16:44.317Z",
  "pubdate": "2026-08-28T08:16:44.317Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) read flaw discovered within the Linux kernel's HID (Human Interface Device) core subsystem.\nThe issue resides in the handling of numbered reports during the execution of hid_get_report().\nAn attacker capable of triggering this code path with a crafted, zero-length report can cause an OOB memory access.\nThe potential impact includes system instability, kernel panics leading to denial-of-service (DoS), or potentially the disclosure of sensitive kernel stack memory if the memory access can be redirected or observed.\nThe vulnerability occurs because the kernel fails to validate the report size before attempting to extract the report ID from the data buffer.\nNo specific authentication is mentioned as a prerequisite, but the exploit likely requires local access to a HID-capable device interface or the ability to inject malicious HID events into the kernel stack.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation within the HID core handling logic, specifically concerning the interaction between hid_report_raw_event() and hid_get_report().\nIn the Linux kernel's HID subsystem, numbered reports utilize the first byte of the data buffer as a report ID. The function hid_get_report() is responsible for retrieving information about a specific report from the device.\nWhen a report is identified as a 'numbered report' (where report_enum->numbered is true), the function attempts to dereference data[0] to obtain the report ID value.\nThe vulnerability is triggered when the caller invokes hid_report_raw_event() with a size parameter of 0 for a numbered report. Because the validation logic for the buffer size occurs after the invocation of hid_get_report(), the kernel blindly attempts to access index 0 of the provided data buffer.\nIf the size is 0, the pointer to the data buffer refers to an empty or invalid memory range, resulting in an OOB read. Depending on the memory layout and the kernel configuration, this dereference can trigger a general protection fault or a kernel panic, effectively crashing the system.\nAttack flow: 1. An attacker interfaces with a device driver or subsystem that utilizes HID reporting. 2. The attacker provides a malformed report packet where the length is defined as 0 while the system expects a numbered report structure. 3. The hid_report_raw_event() function is invoked, subsequently calling hid_get_report() without prior length verification. 4. hid_get_report() dereferences the null or uninitialized data pointer. 5. The memory access violation occurs, leading to a system crash.\nThis flaw represents a failure in the security boundary between raw data processing and data structure validation. By shifting the size validation to occur before the report ID extraction, the kernel ensures that any numbered report access has a minimum buffer size of at least one byte, preventing the OOB read condition entirely."
}