CVE-2026-89620: HID: intel-thc-hid: intel-quickspi: validate report size before copy
In the Linux kernel, the following vulnerability has been resolved:
HID: intel-thc-hid: intel-quickspi: validate report size before copy
writecmdtotxdma() builds an output report in qsdev->reportbuf, a heap buffer allocated in quickspiallocreportbuf() to the device-descriptor derived maxreportlen (a few hundred bytes for a touch controller). It copies the caller-supplied report into that buffer:
memcpy(writebuf->content, reportbuf, reportbuflen);
The HID core caps a report at HIDMAXBUFFERSIZE (16384) by default, and quickspihidlldriver does not set maxbuffersize, so the length reaches the driver unbounded. A hidraw SETREPORT/SETFEATURE ioctl carrying a report larger than maxreportlen therefore overflows reportbuf with attacker-controlled length and content.
Record the reportbuf allocation size and reject reports that do not fit before copying, matching the equivalent guard in the intel-quicki2c sibling (quicki2cinitwritebuf()) and the hid-goodix-spi fix.
writecmdtotxdma() writes the output report header ahead of the content in the same buffer, so size the allocation to cover the header as well. That keeps the added bound from rejecting a maximum-sized report.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux intel-quickspi HID driver for a touch controller are exposed when the driver handles output reports through its hidraw interface. The affected buffer is sized from the device descriptor and is typically only a few hundred bytes.
What does an attacker need to trigger the overflow?
An attacker needs the ability to issue a hidraw SET_REPORT or SET_FEATURE ioctl to the affected device. They must supply a report larger than the device-derived maximum report length; the copied length and content are attacker-controlled.
Is the default HID report-size limit sufficient protection?
No. The HID core permits reports up to HID_MAX_BUFFER_SIZE, which is 16384 by default, while this driver does not set a smaller maximum buffer size. As a result, reports accepted by the HID core can exceed the driver's allocated report buffer.
How is the issue fixed?
The fix records the report buffer allocation size and rejects reports that do not fit before copying them. It also accounts for the output-report header stored in the same buffer when sizing the allocation.