CVE-2026-80781

HID: core: fix OOB read of field->usage in hid_set_field()

Published Sep 4, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: fix OOB read of field->usage in hid_set_field()

hid_set_field() hands field->usage + offset to hid_dump_input() before
the guard that bounds offset:

hid_dump_input(field->report->device, field->usage + offset, value);

if (offset >= field->report_count) {
hid_err(...);
return -1;
}

Under CONFIG_DEBUG_FS hid_dump_input() dereferences that pointer, with
buf = hid_resolv_usage(usage->hid, NULL). The usage[] array is
allocated inline with the hid_field in hid_register_field() and holds
field->maxusage entries, so an offset past it reads off the end of the
kvzalloc()ed allocation and into a neighbouring object. Had the guard
run first, offset < report_count <= maxusage would already have confined
the pointer to the array.

A caller supplies such an offset today. picolcd_fb_send_tile()
validates only report->maxfield before issuing
hid_set_field(report->field[0], 11 + i, ...) for i = 0..31, so its
offsets are fixed at 11..42 and are never checked against the bound
field. When the device registers that field with fewer usages, the
framebuffer deferred-io work drives the read on every tile. KASAN
reports a 4-byte slab-out-of-bounds read in hid_dump_input() below
hid_set_field(), and the same boot logs "offset (1) exceeds
report_count (1)" from the guard that runs only afterwards.

Move the hid_dump_input() call below the guard. Because
field->maxusage >= field->report_count, the guard then establishes that
field->usage + offset lies inside the array before it is dereferenced,
for every caller and without changing behaviour on the valid path.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 465544b3d6602cfbdc2305d5cbfb7f4954353b63
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4993e1ab85d7d3f4a40d81852170f9665483bbd8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 313ead1abed945544703b100a12c5a10fdf78409
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c1d9c16af51cc6ff92a5a062617d3b022dd01078
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a38212687519f2a72f43e62dec1348a690412404
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 9a1d7c5f0d82e8665715d5e47c9410c6a97e3748
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5215ea00a747eca34cb2f603cfef91fef76c2558
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< cbcc0e8dea499e5ca86b583372ccb1815cccc570
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a13cdb19fcb223ed41bdab3bab42b98dba87e90b

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.267`	unaffected	≤ 5.10.*
`5.15.218`	unaffected	≤ 5.15.*
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,465544b3d6602cfbdc2305d5cbfb7f4954353b63)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4993e1ab85d7d3f4a40d81852170f9665483bbd8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,313ead1abed945544703b100a12c5a10fdf78409)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c1d9c16af51cc6ff92a5a062617d3b022dd01078)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a38212687519f2a72f43e62dec1348a690412404)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9a1d7c5f0d82e8665715d5e47c9410c6a97e3748)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5215ea00a747ecc34cb2f603cfef91fef76c2558)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cbcc0e8dea499e5ca86b583372ccb1815cccc570)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a13cdb19fcb223ed41bdab3bab42b98dba87e90b)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.267,5.11.0)`	unaffected	semver	—
`[5.15.218,5.16.0)`	unaffected	semver	—
`[6.1.185,6.2.0)`	unaffected	semver	—
`[6.6.154,6.7.0)`	unaffected	semver	—
`[6.12.106,6.13.0)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.195% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/313ead1abed945544703b100a12c5a10fdf78409
https://git.kernel.org/stable/c/465544b3d6602cfbdc2305d5cbfb7f4954353b63
https://git.kernel.org/stable/c/4993e1ab85d7d3f4a40d81852170f9665483bbd8
https://git.kernel.org/stable/c/5215ea00a747eca34cb2f603cfef91fef76c2558
https://git.kernel.org/stable/c/9a1d7c5f0d82e8665715d5e47c9410c6a97e3748
https://git.kernel.org/stable/c/a13cdb19fcb223ed41bdab3bab42b98dba87e90b
https://git.kernel.org/stable/c/a38212687519f2a72f43e62dec1348a690412404
https://git.kernel.org/stable/c/c1d9c16af51cc6ff92a5a062617d3b022dd01078
https://git.kernel.org/stable/c/cbcc0e8dea499e5ca86b583372ccb1815cccc570

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 4, 2026 5:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125

Sep 4, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field->usage in hid_set_field() hid_set_field() hands field->usage + offset to hid_dump_input() before the guard that bounds offset: hid_dump_input(field->report->device, field->usage + offset, value); if (offset >= field->report_count) { hid_err(...); return -1; } Under CONFIG_DEBUG_FS hid_dump_input() dereferences that pointer, with buf = hid_resolv_usage(usage->hid, NULL). The usage[] array is allocated inline with the hid_field in hid_register_field() and holds field->maxusage entries, so an offset past it reads off the end of the kvzalloc()ed allocation and into a neighbouring object. Had the guard run first, offset < report_count <= maxusage would already have confined the pointer to the array. A caller supplies such an offset today. picolcd_fb_send_tile() validates only report->maxfield before issuing hid_set_field(report->field[0], 11 + i, ...) for i = 0..31, so its offsets are fixed at 11..42 and are never checked against the bound field. When the device registers that field with fewer usages, the framebuffer deferred-io work drives the read on every tile. KASAN reports a 4-byte slab-out-of-bounds read in hid_dump_input() below hid_set_field(), and the same boot logs "offset (1) exceeds report_count (1)" from the guard that runs only afterwards. Move the hid_dump_input() call below the guard. Because field->maxusage >= field->report_count, the guard then establishes that field->usage + offset lies inside the array before it is dereferenced, for every caller and without changing behaviour on the valid path. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Title		HID: core: fix OOB read of field->usage in hid_set_field()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/313ead1abed945544703b100a12c5a10fdf78409 https://git.kernel.org/stable/c/465544b3d6602cfbdc2305d5cbfb7f4954353b63 https://git.kernel.org/stable/c/4993e1ab85d7d3f4a40d81852170f9665483bbd8 https://git.kernel.org/stable/c/5215ea00a747eca34cb2f603cfef91fef76c2558 https://git.kernel.org/stable/c/9a1d7c5f0d82e8665715d5e47c9410c6a97e3748 https://git.kernel.org/stable/c/a13cdb19fcb223ed41bdab3bab42b98dba87e90b https://git.kernel.org/stable/c/a38212687519f2a72f43e62dec1348a690412404 https://git.kernel.org/stable/c/c1d9c16af51cc6ff92a5a062617d3b022dd01078 https://git.kernel.org/stable/c/cbcc0e8dea499e5ca86b583372ccb1815cccc570