{"id":"CVE-2026-80604","summary":"HID: core: Fix OOB read in hid_get_report for numbered reports","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Fix OOB read in hid_get_report for numbered reports\n\nWhen a caller passes a size of 0 to hid_report_raw_event() for a\nnumbered report, the function originally called hid_get_report() before\nperforming any size validation.\n\nInside hid_get_report(), if the report is numbered (report_enum-\u003enumbered\nis true), it unconditionally dereferences data[0] to extract the report ID.\nWith a size of 0, this results in an out-of-bounds read or kernel panic.\n\nFix this by moving the numbered report size validation check before the\ncall to hid_get_report(), ensuring that size is at least 1 before\ndereferencing the data pointer.","aliases":["A-517387820","ASB-A-517387820"],"modified":"2026-11-02T17:11:18.568797991Z","published":"2026-08-28T06:48:29.755Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80604.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/30ff978af92cb51c9ba99f96fc4f4ac80d7001ba"},{"type":"WEB","url":"https://git.kernel.org/stable/c/af1a9b65ebe8a948eda805c14b78d4d0767cb1b5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c1fc0d3aff26ec9ff885b3e4c92eba98cf349678"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c39f5765ad840b71ff8db812d0210f216cca96e4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c973d53bcd420b58c4a34c68198746286d77e9fa"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dd395744e4ed87956fcbf81ecc6a20c51e35fa4e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f7e8117e42b20c30d2a5edab82c944a5e381d791"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f8896b684e246f3f00f45ba2b6803ae59b9cc768"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80604.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80604"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"59bfdb41a34cf5d6af1c637348714c2b5a6ca676"},{"fixed":"f8896b684e246f3f00f45ba2b6803ae59b9cc768"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a4d6cb7cf45bddc76c78ed5fd683328af9e2018f"},{"fixed":"30ff978af92cb51c9ba99f96fc4f4ac80d7001ba"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f"},{"fixed":"c39f5765ad840b71ff8db812d0210f216cca96e4"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9e36568e67f817c728f9d79049d212da79109a75"},{"fixed":"c973d53bcd420b58c4a34c68198746286d77e9fa"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"fb3f7ec2606cdc7c6ef30970f381e571866bfd54"},{"fixed":"c1fc0d3aff26ec9ff885b3e4c92eba98cf349678"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"509c2605065004fc4cd86ee50a9350d402785307"},{"fixed":"dd395744e4ed87956fcbf81ecc6a20c51e35fa4e"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2c85c61d1332e1e16f020d76951baf167dcb6f7a"},{"fixed":"f7e8117e42b20c30d2a5edab82c944a5e381d791"},{"fixed":"af1a9b65ebe8a948eda805c14b78d4d0767cb1b5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.259"},{"fixed":"5.10.261"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.15.210"},{"fixed":"5.15.212"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.1.176"},{"fixed":"6.1.178"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.6.143"},{"fixed":"6.6.145"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.12.93"},{"fixed":"6.12.97"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.18.33"},{"fixed":"6.18.40"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7.0.10"},{"fixed":"7.1"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"710a946b1aa2c35dc56f86621f436938f31ba1a5"}]}],"versions":["v5.10.260","v5.10.259","v5.15.211","v5.15.210","v6.1.177","v6.1.176","v6.6.144","v6.6.143","v6.12.96","v6.12.95","v6.12.94","v6.12.93","v6.18.39","v6.18.38","v6.18.37","v6.18.36","v6.18.35","v6.18.34","v6.18.33","v7.0.14","v7.0.13","v7.0.12","v7.0.11","v7.0.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80604.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.261"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80604.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}