CVE-2026-80604HID: core: Fix OOB read in hid_get_report for numbered reports
- 8.8HighCVSS base score
- 0.41%Exploitation in 30 daysEPSS · top 64% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.
Timeline
ID reserved
By Linux
- 2 days later
· 2 days later
Published
- 49 days later
· 49 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.41% · top 64% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
- affected 59bfdb41a34cf5d6af1c637348714c2b5a6ca676 – < f8896b684e246f3f00f45ba2b6803ae59b9cc768
- affected a4d6cb7cf45bddc76c78ed5fd683328af9e2018f – < 30ff978af92cb51c9ba99f96fc4f4ac80d7001ba
- affected 121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f – < c39f5765ad840b71ff8db812d0210f216cca96e4
- affected 9e36568e67f817c728f9d79049d212da79109a75 – < c973d53bcd420b58c4a34c68198746286d77e9fa
- affected fb3f7ec2606cdc7c6ef30970f381e571866bfd54 – < c1fc0d3aff26ec9ff885b3e4c92eba98cf349678
- affected 509c2605065004fc4cd86ee50a9350d402785307 – < dd395744e4ed87956fcbf81ecc6a20c51e35fa4e
- affected 2c85c61d1332e1e16f020d76951baf167dcb6f7a – < f7e8117e42b20c30d2a5edab82c944a5e381d791
- affected 2c85c61d1332e1e16f020d76951baf167dcb6f7a – < af1a9b65ebe8a948eda805c14b78d4d0767cb1b5
- affected 710a946b1aa2c35dc56f86621f436938f31ba1a5
- affected 5.10.259 – < 5.10.261
- affected 5.15.210 – < 5.15.212
- affected 6.1.176 – < 6.1.178
- affected 6.6.143 – < 6.6.145
- affected 6.12.93 – < 6.12.97
- affected 6.18.33 – < 6.18.40
- affected 7.0.10 – < 7.1
- affected 7.1
- unaffected < 7.1
- unaffected 5.10.261 – ≤ 5.10.*
- unaffected 5.15.212 – ≤ 5.15.*
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.97 – ≤ 6.12.*
- unaffected 6.18.40 – ≤ 6.18.*
- unaffected 7.1.5 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/f8896b684e246f3f00f45ba2b6803ae59b9cc768 (opens in a new tab)
- https://git.kernel.org/stable/c/30ff978af92cb51c9ba99f96fc4f4ac80d7001ba (opens in a new tab)
- https://git.kernel.org/stable/c/c39f5765ad840b71ff8db812d0210f216cca96e4 (opens in a new tab)
- https://git.kernel.org/stable/c/c973d53bcd420b58c4a34c68198746286d77e9fa (opens in a new tab)
- https://git.kernel.org/stable/c/c1fc0d3aff26ec9ff885b3e4c92eba98cf349678 (opens in a new tab)
- https://git.kernel.org/stable/c/dd395744e4ed87956fcbf81ecc6a20c51e35fa4e (opens in a new tab)
- https://git.kernel.org/stable/c/f7e8117e42b20c30d2a5edab82c944a5e381d791 (opens in a new tab)
- https://git.kernel.org/stable/c/af1a9b65ebe8a948eda805c14b78d4d0767cb1b5 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-67480 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-80604)Record last updated .