CVE-2026-89729 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write.
HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel's Human Interface Device subsystem contains a critical memory corruption vulnerability within the sensor_hub_get_feature function, which is responsible for retrieving feature reports from HID sensors connected via USB or Bluetooth interfaces. This flaw arises from an inconsistency between how the function validates input parameters and how it executes data copying operations. Specifically, while the code correctly clamps the overall return value to ensure it does not exceed the size of the caller's provided buffer, the internal copy loop fails to apply this same constraint during the actual memory write operation. The loop iterates through report values and copies a fixed number of bytes calculated as field->report_size divided by eight for each individual value. This calculation assumes that the data fits within standard integer slots but does not account for cases where the advertised feature field size in the HID descriptor is artificially inflated or malformed, leading to writes beyond the allocated stack buffer boundaries.
This vulnerability represents a classic out-of-bounds write condition, categorized under CWE-787: Out-of-Bounds Write in industry standards. The root cause lies in the lack of synchronization between the logical bounds checking and the physical memory access logic within the driver implementation. A malicious HID device or a crafted USB descriptor can advertise a feature field with an excessively large report size. When such a descriptor is processed, the sensor_hub_get_feature function proceeds to copy data based on this advertised size rather than the actual capacity of the destination buffer provided by the caller. In typical usage scenarios, callers may supply small stack buffers, such as those allocated for single 32-bit signed integers (s32), expecting only a few bytes of data. However, due to the flawed loop logic, the kernel attempts to write significantly more data than available space permits, resulting in heap or stack buffer overflow depending on the allocation context.
The operational impact of this vulnerability is severe, as it allows for arbitrary memory overwrite capabilities within the kernel address space. An attacker with physical access to a USB port or proximity via Bluetooth can exploit this flaw by presenting a malicious HID sensor descriptor that triggers the out-of-bounds write. This exploitation vector aligns with ATT&CK technique T1203: Exploitation for Client Execution, where an adversary uses trusted software mechanisms like device drivers to gain initial access and escalate privileges. By overwriting adjacent memory structures, such as function pointers or return addresses on the stack, a local attacker can achieve arbitrary code execution with kernel-level privileges. This effectively compromises the integrity of the entire operating system, allowing for full system takeover, data exfiltration, or persistence mechanisms that are difficult to detect due to their deep integration into core subsystems.
The resolution implemented in this patch addresses the vulnerability by enforcing stricter validation and bounds checking at multiple levels within the sensor_hub_get_feature function. First, the code now rejects feature fields that require more than one slot per value, preventing scenarios where large report sizes are processed against small integer buffers. Second, a guard is added to validate the total byte count calculation before any copying occurs, ensuring that the cumulative size of all values does not exceed safe limits relative to the buffer capacity. Finally, each individual copy operation within the loop is clamped to ensure it never exceeds the remaining space in the caller's buffer. These changes align with secure coding practices recommended by CWE-120: Buffer Copy without Checking Size of Input and mitigate the risk of memory corruption by ensuring that all data transfers are strictly bounded by the actual available destination size rather than potentially malicious source descriptors.
To further enhance security posture, system administrators should ensure that kernel updates containing this fix are applied promptly to systems exposed to untrusted HID devices. Additionally, organizations deploying Linux-based IoT or embedded devices with external sensor interfaces should consider implementing strict USB device filtering policies and disabling unnecessary HID features where possible. Regular auditing of driver code for similar patterns of unchecked buffer operations is also recommended to prevent analogous vulnerabilities in other subsystems that interact with user-controlled hardware descriptors.