CVE-2026-80918: HID: core: fix number/pointer type confusion on long items
In the Linux kernel, the following vulnerability has been resolved:
HID: core: fix number/pointer type confusion on long items
When fetchitem() is called by hidscanreport() on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item->data.longdata instead of storing a value directly in item->data.{u8/u16/u32}.
When itemudata() or itemsdata() encounters such an item, it incorrectly assumes that the item is in short format, and therefore returns the lower part of a kernel pointer reinterpreted as a number.
When a HID device is connected whose descriptor contains a HIDGLOBALITEMTAGREPORTSIZE encoded in long format with size=4, this causes the lower half of a kernel pointer to be printed into dmesg as a number, like this:
hid (null): invalid reportsize 107953555
To fix it, let itemudata() and itemsdata() verify that the item is in short format.
Note that this bug only affects hidscanreport(), while the main parsing pass hidparsecollections() will always bail out when encountering a long item.
Sidenote: There are currently no users of data.longdata; maybe we should just remove any parsing of long-format descriptors as a follow-up.
Affected Software
Event History
Frequently Asked Questions
What attacker-controlled input is required to trigger the issue?
A connected HID device must provide a descriptor containing a HID_GLOBAL_ITEM_TAG_REPORT_SIZE item encoded in long format with a size of 4. The issue is reached while the kernel scans that device's report descriptor.
Is the main HID descriptor parsing path affected?
No. The issue affects hid_scan_report(); the main parsing pass, hid_parse_collections(), bails out when it encounters a long item.
How might an affected system reveal the problem?
The kernel may print an invalid report_size value to dmesg, such as "hid (null): invalid report_size 107953555". That value can be the lower portion of a kernel pointer interpreted as a number.
What should be avoided until the fix is deployed?
Avoid connecting HID devices whose report descriptors contain long-format REPORT_SIZE items, particularly size-4 items. The supplied fix changes the item accessors so they verify that an item is in short format before interpreting its data as a numeric value.