CVE-2026-98860
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to size_t when compared against size. This causes the negative error code to evaluate as a large positive number, making the (ret > size) condition true.
This silently converts the hardware error into a success return value and copies the unmodified buffer back, which could leave BPF programs operating on uninitialized or stale data.
Read full descriptionShow less
Fix this by casting size into ssize_t to return the actual negative error code.
CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.16 %
- Percentile among all scored CVEs
- 4
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Show 4 references
Raw JSON (NVD)
Show
{
"id": "CVE-2026-98860",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d6efaa50af62fb0790dd1fd4e7e5506b46312510",
"lessThan": "8b85ef0f561039e249c3f883c5280a1449c6dbee",
"versionType": "git"
},
{
"status": "affected",
"version": "73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1",
"lessThan": "97be6396817bd3b11d06239010d27902940bfaa9",
"versionType": "git"
},
{
"status": "affected",
"version": "2b658c1c442ec1cd9eec5ead98d68662c40fe645",
"lessThan": "f9f808227554b2c116fd07dd2328ecd74ea3f411",
"versionType": "git"
},
{
"status": "affected",
"version": "2b658c1c442ec1cd9eec5ead98d68662c40fe645",
"lessThan": "3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c",
"versionType": "git"
},
{
"status": "affected",
"version": "eb57dae20fdf6f3069cdc07821fa3bb46de381d7",
"versionType": "git"
},
{
"status": "affected",
"version": "6.12.78",
"lessThan": "6.12.113",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.20",
"lessThan": "6.18.56",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.19.10",
"lessThan": "6.20",
"versionType": "semver"
}
],
"programFiles": [
"drivers/hid/bpf/hid_bpf_dispatch.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/hid/bpf/hid_bpf_dispatch.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:40.470",
"references": [
{
"url": "https://git.kernel.org/stable/c/3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b85ef0f561039e249c3f883c5280a1449c6dbee",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/97be6396817bd3b11d06239010d27902940bfaa9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f9f808227554b2c116fd07dd2328ecd74ea3f411",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: cast size to ssize_t when checking hid_bpf_hw_request\n\nAs reported by Sashiko:\nIf a transport driver encounters a hardware error and returns a negative\nerror code such as -EPIPE, ret is implicitly promoted to size_t when\ncompared against size. This causes the negative error code to evaluate\nas a large positive number, making the (ret > size) condition true.\n\nThis silently converts the hardware error into a success return value\nand copies the unmodified buffer back, which could leave BPF programs\noperating on uninitialized or stale data.\n\nFix this by casting size into ssize_t to return the actual negative\nerror code."
}
],
"lastModified": "2026-10-19T10:19:50.087",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}