Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-28T00:00:00 kernel: HID: core: Fix OOB read in hid_get_report for numbered reports 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.

A flaw was found in the Linux kernel's Human Interface Device (HID) core. When processing numbered reports, the `hid_get_report()` function can attempt to read data from an invalid memory location if a size of zero is provided. This out-of-bounds read can lead to a kernel panic, effectively causing a denial of service for the system.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-80604 https://nvd.nist.gov/vuln/detail/CVE-2026-80604 https://lore.kernel.org/linux-cve-announce/2026082832-CVE-2026-80604-5909@gregkh/T