CVE-2026-23178: HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
In the Linux kernel, the following vulnerability has been resolved:
HID: i2c-hid: fix potential buffer overflow in i2chidgetreport()
i2chidxfer is used to read recvlen + sizeof(le16) bytes of data into ihid->rawbuf.
The former can come from the userspace in the hidraw driver and is only bounded by HIDMAXBUFFERSIZE(16384) by default (unless we also set maxbuffersize field of struct hidlldriver which we do not).
The latter has size determined at runtime by the maximum size of different report types you could receive on any particular device and can be a much smaller value.
Fix this by truncating recvlen to ihid->bufsize - sizeof(le16).
The impact is low since access to hidraw devices requires root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel HID i2c-hid implementation, truncate recv_len to ihid->bufsize - sizeof(__le16) before i2c_hid_xfer reads recv_len + sizeof(__le16) bytes into ihid->rawbuf.
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
Exploitation requires access to a hidraw device, which requires root access. The described impact is therefore low for systems where untrusted users do not have root-level access.
What input triggers the overflow condition?
A userspace caller through the hidraw driver can supply recv_len up to the default HID_MAX_BUFFER_SIZE of 16384 bytes. For an affected I2C HID device, the allocated raw buffer may be smaller because its size is based on the device's maximum report sizes, allowing the requested read plus the two-byte length field to exceed that buffer.
What does the fix change?
The fix limits recv_len to ihid->bufsize minus sizeof(__le16), ensuring that the transfer length, including the length field, cannot exceed ihid->rawbuf.