« Volver al listado

CVE-2026-80918

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

HID: core: fix number/pointer type confusion on long items

When fetch_item() is called by hid_scan_report() on an item with HID_ITEM_TAG_LONG, it stores a pointer to the item data in item->data.longdata instead of storing a value directly in item->data.{u8/u16/u32}.

When item_udata() or item_sdata() encounters such an item, it incorrectly assumes that the item is in short format, and therefore returns the lower part of a kernel pointer reinterpreted as a number.

When a HID device is connected whose descriptor contains a HID_GLOBAL_ITEM_TAG_REPORT_SIZE encoded in long format with size=4, this causes the lower half of a kernel pointer to be printed into dmesg as a number, like this:

Leer descripción completaMostrar menos

To fix it, let item_udata() and item_sdata() verify that the item is in short format.

Note that this bug only affects hid_scan_report(), while the main parsing pass hid_parse_collections() will always bail out when encountering a long item.

Sidenote: There are currently no users of data.longdata; maybe we should just remove any parsing of long-format descriptors as a follow-up.

Detalles técnicos trazas, registros y código del informe original
    hid (null): invalid report_size 107953555

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80918",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "lessThan": "bed7fe3a936b6bdd84671385951397ca673cf6e7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "lessThan": "aec2c2ec87d4ec1f098979f68cd81b29f031c8cb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "lessThan": "634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "lessThan": "abec577de5fc16cd5caae42f97cdcd0983c06d66",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "lessThan": "dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "lessThan": "1fa1591efd417e39e5e164bebea8ca7a3837c469",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "lessThan": "e60159f5ea60254a5c3de4ea4f2f939f0171031b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "lessThan": "e542edada3f79387c0ac2a528cebf01f4ef47df8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "lessThan": "28abce951343fcec26e397610868efa4e1395c3f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-09T17:17:46.847",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1fa1591efd417e39e5e164bebea8ca7a3837c469",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/28abce951343fcec26e397610868efa4e1395c3f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/abec577de5fc16cd5caae42f97cdcd0983c06d66",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/aec2c2ec87d4ec1f098979f68cd81b29f031c8cb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bed7fe3a936b6bdd84671385951397ca673cf6e7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e542edada3f79387c0ac2a528cebf01f4ef47df8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e60159f5ea60254a5c3de4ea4f2f939f0171031b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: fix number/pointer type confusion on long items\n\nWhen fetch_item() is called by hid_scan_report() on an item with\nHID_ITEM_TAG_LONG, it stores a pointer to the item data in\nitem->data.longdata instead of storing a value directly in\nitem->data.{u8/u16/u32}.\n\nWhen item_udata() or item_sdata() encounters such an item, it incorrectly\nassumes that the item is in short format, and therefore returns the lower\npart of a kernel pointer reinterpreted as a number.\n\nWhen a HID device is connected whose descriptor contains a\nHID_GLOBAL_ITEM_TAG_REPORT_SIZE encoded in long format with size=4, this\ncauses the lower half of a kernel pointer to be printed into dmesg as a\nnumber, like this:\n\n    hid (null): invalid report_size 107953555\n\nTo fix it, let item_udata() and item_sdata() verify that the item is in\nshort format.\n\nNote that this bug only affects hid_scan_report(), while the main parsing\npass hid_parse_collections() will always bail out when encountering a long\nitem.\n\nSidenote: There are currently no users of data.longdata; maybe we should\njust remove any parsing of long-format descriptors as a follow-up."
    }
  ],
  "lastModified": "2026-09-09T17:17:46.847",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}