Home

Description

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guarantees that the value makes sense.

PUBLISHED Reserved 2026-03-09 | Published 2026-04-03 | Updated 2026-05-11 | Assigner Linux




HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Product status

Default status
unaffected

8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 (git) before d6efaa50af62fb0790dd1fd4e7e5506b46312510
affected

8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 (git) before 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1
affected

8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 (git) before eb57dae20fdf6f3069cdc07821fa3bb46de381d7
affected

8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 (git) before 2b658c1c442ec1cd9eec5ead98d68662c40fe645
affected

Default status
affected

6.11
affected

Any version before 6.11
unaffected

6.12.78 (semver)
unaffected

6.18.20 (semver)
unaffected

6.19.10 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/d6efaa50af62fb0790dd1fd4e7e5506b46312510

git.kernel.org/...c/73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1

git.kernel.org/...c/eb57dae20fdf6f3069cdc07821fa3bb46de381d7

git.kernel.org/...c/2b658c1c442ec1cd9eec5ead98d68662c40fe645

cve.org (CVE-2026-31401)

nvd.nist.gov (CVE-2026-31401)

Download JSON