UBUNTU-CVE-2026-89620: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma() builds an output report in qsdev->reportbuf, a heap buffer allocated in quickspiallocreportbuf() to the device-descriptor derived maxreportlen (a few hundred bytes for a touch controller). It copies the caller-supplied report into that buffer: memcpy(writebuf->content, reportbuf, reportbuflen); The HID core caps a report at HIDMAXBUFFERSIZE (16384) by default, and quickspihidlldriver does not set maxbuffersize, so the length reaches the driver unbounded. A hidraw SETREPORT/SETFEATURE ioctl carrying a report larger than maxreportlen therefore overflows reportbuf with attacker-controlled length and content. Record the reportbuf allocation size and reject reports that do not fit before copying, matching the equivalent guard in the intel-quicki2c sibling (quicki2cinitwritebuf()) and the hid-goodix-spi fix. writecmdtotxdma() writes the output report header ahead of the content in the same buffer, so size the allocation to cover the header as well. That keeps the added bound from rejecting a maximum-sized report.