CVE-2026-90000: HID: rmi: fix OOB access with undersized RMI reports
HID: rmi: fix OOB access with undersized RMI reports
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Which systems are exposed?
Systems using the Linux kernel hid-rmi driver are exposed when they interact with an RMI device that supplies undersized HID report descriptors. A device declaring 1-byte input and output reports can cause the driver to allocate only four bytes for buffers that later receive larger fixed-offset accesses.
What does an attacker-controlled device need to do to trigger the issue?
The device must control the HID report descriptor and provide undersized report lengths. The probe path reaches rmi_set_page() unconditionally, and a device-controlled value in readReport[1] can request a read-path copy of up to 255 bytes starting at readReport[2].
Is user interaction required after the device is probed?
The described write-side out-of-bounds accesses occur during probe because rmi_set_page() is reached unconditionally through rmi_input_configured(). The read path can then use device-supplied reply data to determine the copy length.