« Volver al listado

CVE-2026-89729

Estado: RecibidaAlta (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write.

HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:A (red adyacente) sin privilegios → T1210. OOB write en kernel permite escalada a root (T1068) o DoS (T1499.004) mediante descriptor HID malicioso.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningPrivileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89729",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5459ada2b3cd69e6bf1b0c034feb810975d0072b",
              "lessThan": "1c0463f0f028801a933f090cd2695f132635b374",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5459ada2b3cd69e6bf1b0c034feb810975d0072b",
              "lessThan": "4145aa149a32e4b35d5d47e380d0c6c438b4e6fe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5459ada2b3cd69e6bf1b0c034feb810975d0072b",
              "lessThan": "8bf8aaf2f74de64f801eb30bc38927dba1f8e40a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5459ada2b3cd69e6bf1b0c034feb810975d0072b",
              "lessThan": "c5c60260a07e627084e792ea959ab468ccfa4d50",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5459ada2b3cd69e6bf1b0c034feb810975d0072b",
              "lessThan": "fa95b14198b6c8ea721b4784f466d3c2c2bac83a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5459ada2b3cd69e6bf1b0c034feb810975d0072b",
              "lessThan": "9f43499ce6458a572b781f6bb46c464ab59fa825",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5459ada2b3cd69e6bf1b0c034feb810975d0072b",
              "lessThan": "bc3d72c44bff17688dc5f3e5132a53b51dae0f04",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5459ada2b3cd69e6bf1b0c034feb810975d0072b",
              "lessThan": "c92693f3ed099401d0383ef35ca1fe1e6ba033de",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-sensor-hub.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-sensor-hub.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:20:03.240",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1c0463f0f028801a933f090cd2695f132635b374",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4145aa149a32e4b35d5d47e380d0c6c438b4e6fe",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8bf8aaf2f74de64f801eb30bc38927dba1f8e40a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9f43499ce6458a572b781f6bb46c464ab59fa825",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bc3d72c44bff17688dc5f3e5132a53b51dae0f04",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c5c60260a07e627084e792ea959ab468ccfa4d50",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c92693f3ed099401d0383ef35ca1fe1e6ba033de",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fa95b14198b6c8ea721b4784f466d3c2c2bac83a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature\n\nsensor_hub_get_feature() clamps its return value to the caller's buffer\nsize, but the copy loop still copies field->report_size / 8 bytes for\neach report value. A malicious HID descriptor can advertise a large\nfeature field size while an IIO caller supplies a small stack buffer,\nsuch as a single s32, causing an out-of-bounds write.\n\nHID core stores parsed report values in __s32 slots and clamps extracted\nvalues to 32 bits. Reject feature fields that require more than one slot\nper value, guard the total byte count calculation, and clamp each\nper-value copy to the remaining caller buffer."
    }
  ],
  "lastModified": "2026-09-14T13:19:22.020",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}