CVE-2026-64367: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
goodixhidsetrawreport() builds a protocol frame in a 128-byte stack buffer (tmpbuf), writing an 11-12 byte header followed by the caller-supplied report data. The HID core caps report size at HIDMAXBUFFERSIZE (16384) by default, while the driver does not set hidlldriver.maxbuffersize and performs no bounds checking before copying the payload:
memcpy(tmpbuf + txlen, buf, len);
A hidraw SETREPORT ioctl with a report larger than ~116 bytes overflows the stack buffer.
Add a size check after constructing the header, rejecting reports that would exceed the buffer capacity.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a size check after constructing the header in goodix_hid_set_raw_report(): reject SET_REPORT payloads that would exceed the stack buffer capacity (tmp_buf), before copying payload data with memcpy.
goodix_hid_set_raw_report (Goodix HID SPI driver) validate report size before memcpy(tmp_buf + tx_len, buf, len) = reject when constructed frame would exceed tmp_buf capacity
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation requires local, low-privileged access and the ability to issue a hidraw SET_REPORT ioctl with an oversized report. No user interaction is required.
Are the HID core's normal report-size limits enough to prevent exploitation?
No. The HID core permits reports up to HID_MAX_BUFFER_SIZE, which is 16384 bytes by default, while the affected driver constructs frames in a 128-byte stack buffer without setting a smaller maximum or validating the payload length.
How large must a report be to trigger the overflow condition?
A report larger than approximately 116 bytes can overflow the driver's stack buffer after its 11- to 12-byte protocol header is added.
What is the potential impact if exploitation succeeds?
The CVSS vector rates confidentiality, integrity, and availability impact as high. The overflow occurs in a kernel driver stack buffer.