CVE-2026-89729: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
In the Linux kernel, the following vulnerability has been resolved:
HID: sensor-hub: Fix out-of-bounds write in sensorhubgetfeature
sensorhubgetfeature() clamps its return value to the caller's buffer size, but the copy loop still copies field->reportsize / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write.
HID core stores parsed report values in s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel HID sensor-hub path are exposed when they process a malicious HID descriptor containing an oversized feature field. The vulnerable path can be reached when an IIO caller provides a small buffer, including a single s32 stack buffer.
What does an attacker need to exploit it?
An attacker needs to cause the system to process a malicious HID descriptor that advertises a large feature field size. The descriptor must be handled through sensor_hub_get_feature() in a context where the caller buffer is smaller than the reported field data.
What mitigations are available if an update cannot be applied immediately?
The provided information does not identify a configuration workaround. Reducing exposure to untrusted or malicious HID devices and descriptors would limit the stated attack condition.
How is the issue addressed by the fix?
The fix rejects feature fields requiring more than one 32-bit slot per value, guards the total byte-count calculation, and limits each copied value to the caller buffer space remaining.