CVE-2026-80604 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: core: Fix OOB read in hid_get_report for numbered reports
When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation.
Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID.
With a size of 0, this results in an out-of-bounds read or kernel panic.
Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The Linux Kernel Input Device subsystem contains a critical memory safety vulnerability within the Human Interface Device core component, specifically affecting the handling of numbered reports in the hid_get_report function. This flaw arises from an improper sequence of operations during input event processing where size validation is performed after unsafe memory access rather than before it. The vulnerability manifests when a caller invokes hid_report_raw_event with a buffer size of zero for a report that requires identification via a leading byte, commonly known as a numbered report in HID protocol terminology. In such scenarios, the original implementation attempted to retrieve and parse the report structure without first verifying whether sufficient data was available to safely read the required fields.
Inside the hid_get_report function logic, when dealing with numbered reports indicated by the report_enum->numbered flag being true, the code unconditionally dereferences the first byte of the input buffer at index zero to extract the report ID. This operation assumes that at least one byte is present in the provided data array. However, if the size parameter passed from hid_report_raw_event is zero, this assumption fails catastrophically. The attempt to read data[0] results in an out-of-bounds memory access because no valid bytes exist within the buffer context for such a request. This type of error falls squarely under CWE-125 Out-of-Bounds Read, as it involves reading beyond the intended boundary of a memory region, potentially exposing sensitive kernel memory contents or causing undefined behavior depending on what lies adjacent to the allocated buffer in physical memory.
The operational impact of this vulnerability is severe and can lead directly to system instability. When an out-of-bounds read occurs within the Linux kernel space, it often triggers a page fault that cannot be handled gracefully by the kernel's exception handling mechanisms for user-space faults. Consequently, this typically results in a kernel panic or a complete system crash, effectively causing a denial of service against the host machine. An attacker who can influence the size parameter passed to hid_report_raw_event could exploit this condition to force the kernel into an invalid state. While exploitation primarily targets availability through crashing the system, depending on memory layout and specific hardware architectures, there may be secondary implications regarding information disclosure if the out-of-bounds read retrieves data that is subsequently used in further processing or logged by debugging mechanisms.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability represents an initial vector for disrupting service availability rather than direct code execution. It aligns with techniques related to resource exhaustion and system crash induction. The root cause is classified as CWE-20 Improper Input Validation because the software fails to adequately verify that input data meets expected constraints before processing it. Specifically, the validation logic lacked a precondition check ensuring that the buffer length was sufficient for the operations being performed on numbered reports which inherently require at least one byte for identification purposes.
To mitigate this vulnerability and prevent similar issues in future development cycles, the fix involves reordering the control flow within hid_report_raw_event to perform strict size validation prior to invoking hid_get_report. By ensuring that the size parameter is greater than or equal to one before any attempt is made to dereference data[0], the kernel guarantees memory safety for numbered report handling. Developers should adopt a defense-in-depth approach by implementing early input validation checks at all entry points where external or untrusted data influences internal buffer operations. Additionally, static analysis tools and fuzzing campaigns targeting HID subsystems can help identify similar patterns of premature dereferencing in other parts of the kernel codebase to ensure comprehensive coverage against out-of-bounds access vulnerabilities.