{"id":"AZL-99407","summary":"CVE-2026-80781 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: fix OOB read of field-\u003eusage in hid_set_field()\n\nhid_set_field() hands field-\u003eusage + offset to hid_dump_input() before\nthe guard that bounds offset:\n\n\thid_dump_input(field-\u003ereport-\u003edevice, field-\u003eusage + offset, value);\n\n\tif (offset \u003e= field-\u003ereport_count) {\n\t\thid_err(...);\n\t\treturn -1;\n\t}\n\nUnder CONFIG_DEBUG_FS hid_dump_input() dereferences that pointer, with\nbuf = hid_resolv_usage(usage-\u003ehid, NULL).  The usage[] array is\nallocated inline with the hid_field in hid_register_field() and holds\nfield-\u003emaxusage entries, so an offset past it reads off the end of the\nkvzalloc()ed allocation and into a neighbouring object.  Had the guard\nrun first, offset \u003c report_count \u003c= maxusage would already have confined\nthe pointer to the array.\n\nA caller supplies such an offset today.  picolcd_fb_send_tile()\nvalidates only report-\u003emaxfield before issuing\nhid_set_field(report-\u003efield[0], 11 + i, ...) for i = 0..31, so its\noffsets are fixed at 11..42 and are never checked against the bound\nfield.  When the device registers that field with fewer usages, the\nframebuffer deferred-io work drives the read on every tile.  KASAN\nreports a 4-byte slab-out-of-bounds read in hid_dump_input() below\nhid_set_field(), and the same boot logs \"offset (1) exceeds\nreport_count (1)\" from the guard that runs only afterwards.\n\nMove the hid_dump_input() call below the guard.  Because\nfield-\u003emaxusage \u003e= field-\u003ereport_count, the guard then establishes that\nfield-\u003eusage + offset lies inside the array before it is dereferenced,\nfor every caller and without changing behaviour on the valid path.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e","modified":"2026-09-05T14:16:56.869048085Z","published":"2026-09-04T16:18:03Z","upstream":["CVE-2026-80781"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80781"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99407.json"}}],"schema_version":"1.9.0"}