CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: prevent buffer overflow in hidhwrequest
right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatchhidbpfrawrequests(), which calls the structops and we have no guarantees that the value makes sense.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31401?
CVE-2026-31401 is classified as a high-severity vulnerability due to its potential for buffer overflow exploitation.
How do I fix CVE-2026-31401?
To fix CVE-2026-31401, ensure that you update your Linux kernel to the latest stable version that includes the patch.
What software is affected by CVE-2026-31401?
CVE-2026-31401 affects the Linux kernel, particularly the portions related to HID-BPF functionality.
What type of vulnerability is CVE-2026-31401?
CVE-2026-31401 is a buffer overflow vulnerability that can arise during HID hardware requests.
Can CVE-2026-31401 be exploited remotely?
Yes, CVE-2026-31401 could potentially be exploited remotely if an attacker can interact with the affected HID devices.