CVE-2026-31624: HID: core: clamp report_size in s32ton() to avoid undefined shift
HID: core: clamp reportsize in s32ton() to avoid undefined shift
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.137.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In Linux HID core, clamp the maximum value of n/report_size to 32 in s32ton(), preventing shifts by report_size - 1 from exceeding the 32-bit type width.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31624?
CVE-2026-31624 has been classified as a low severity vulnerability affecting the Linux kernel.
How do I fix CVE-2026-31624?
To fix CVE-2026-31624, update to the latest version of the Linux kernel where this vulnerability has been addressed.
What impact does CVE-2026-31624 have on system security?
CVE-2026-31624 could lead to undefined behavior due to shifts in data, potentially causing system instability.
Which versions of the Linux kernel are affected by CVE-2026-31624?
CVE-2026-31624 affects multiple versions of the Linux kernel prior to the fix, but specific versions depend on the patching status.
What is the cause of CVE-2026-31624?
CVE-2026-31624 is caused by improper handling of the report_size in the s32ton() function, leading to potential undefined shifts.