CVE-2026-98206: Input: cyttsp5 - clamp the HID report size before memcpy
Published Oct 6, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
Input: cyttsp5 - clamp the HID report size before memcpy
The size field comes from the device and is used as the memcpy() length into responsebuf, which is CYMAXINPUT bytes.
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Clamp the device-supplied HID report size to CY_MAX_INPUT before using it as the memcpy() length into response_buf.
Event History
Oct 6, 2026
CVE Published
via MITRE·08:44 AM
Data Sourced
via MITRE·08:44 AM
Description
Data Sourced
via NVD·09:18 AM
Description
Oct 7, 2026
Data Sourced
via Microsoft·08:11 AM
DescriptionSeverityWeakness