CVE-2026-98860: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: cast size to ssizet when checking hidbpfhwrequest
As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to sizet when compared against size. This causes the negative error code to evaluate as a large positive number, making the (ret > size) condition true.
This silently converts the hardware error into a success return value and copies the unmodified buffer back, which could leave BPF programs operating on uninitialized or stale data.
Fix this by casting size into ssizet to return the actual negative error code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel HID BPF handling, cast size to ssize_t when checking hid_bpf_hw_request so negative hardware error codes such as -EPIPE are returned instead of being implicitly converted to size_t.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
A HID BPF hardware request must encounter a transport-driver hardware error that returns a negative error code, such as -EPIPE. The flawed comparison can then treat that error as success and copy an unmodified buffer back to the BPF program.
What is the practical impact of the incorrect success result?
BPF programs may operate on uninitialized or stale data because the hardware error is silently converted into a successful return value. The corrected code returns the original negative error code instead.