CVE-2026-80604: HID: core: Fix OOB read in hid_get_report for numbered reports
In the Linux kernel, the following vulnerability has been resolved:
HID: core: Fix OOB read in hidgetreport for numbered reports
When a caller passes a size of 0 to hidreportrawevent() for a numbered report, the function originally called hidgetreport() before performing any size validation.
Inside hidgetreport(), if the report is numbered (reportenum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic.
Fix this by moving the numbered report size validation check before the call to hidgetreport(), ensuring that size is at least 1 before dereferencing the data pointer.
Affected Software
Event History
Frequently Asked Questions
Which HID report configurations are affected?
The issue applies to numbered HID reports, where the report ID is read from the first byte of the input buffer. The described out-of-bounds read does not apply to reports that are not numbered.
What condition is needed to trigger the failure?
A caller must invoke hid_report_raw_event() with a zero-length input for a numbered report. Before the fix, the kernel could read data[0] despite the size being zero, resulting in an out-of-bounds read or kernel panic.