In logi_dj_probe of hid-logitech-dj.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/kernel/common/+/17843f6d225d81b6f210b89bd54123611de7bba7",
"https://android.googlesource.com/kernel/common/+/c47a6316399f7dfbddb1d383578838e3969ae90f",
"https://android.googlesource.com/kernel/common/+/5db2dcc7b20c370157de9a46978d5a3d005b169c",
"https://android.googlesource.com/kernel/common/+/6f13426533c438eaf78caf2a8171fc839417dd45",
"https://android.googlesource.com/kernel/common/+/a1f098e5a82ad297062244ee20a44b6131c199c1",
"https://android.googlesource.com/kernel/common/+/2b71b414641a5cac8a3bf2a736518e09a73badf5"
],
"severity": "High",
"spl": "2026-11-05",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"340215990362575188973508260586870994715",
"63183454383030324871899403167023556513",
"190080670770210385505531757060346883680",
"275614720648815378961248126820803083600",
"96426450544813789957816404461859648627",
"164864472289946004093544157643867715957",
"204278942218713104271161147033169866530",
"297971088892453897446678769591357791711",
"335154687195259287737458056100516791818",
"310691086589449036332350407205234219396",
"213309331825620047631057825060354168313",
"207048503474081623595343351867269951546",
"66509561907561480247599337972372402873",
"158980291156439085660719555716175021523",
"38302755505301350646471775696505077552",
"8949922676151344661182002519421110912",
"12627243266421778123030425707825799013",
"5430620074926550738449180198898223131",
"326076827521064487102033330909101746401"
],
"threshold": 0.9
},
"id": "ASB-A-489036052-3109d4ca",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/2b71b414641a5cac8a3bf2a736518e09a73badf5",
"target": {
"file": "drivers/hid/hid-logitech-dj.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"239376281237100324232258991761957438419",
"256891356508157938181854098198998064635",
"183669323355434746929820750661357422404",
"141031170353821710641307093482238103287"
],
"threshold": 0.9
},
"id": "ASB-A-489036052-6f31a5ce",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/6f13426533c438eaf78caf2a8171fc839417dd45",
"target": {
"file": "drivers/hid/hid-logitech-dj.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "210008752323922029594929459506713429218",
"length": 2577
},
"id": "ASB-A-489036052-7e4d6f70",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/6f13426533c438eaf78caf2a8171fc839417dd45",
"target": {
"file": "drivers/hid/hid-logitech-dj.c",
"function": "logi_dj_probe"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "210008752323922029594929459506713429218",
"length": 2577
},
"id": "ASB-A-489036052-a1d67ac1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/17843f6d225d81b6f210b89bd54123611de7bba7",
"target": {
"file": "drivers/hid/hid-logitech-dj.c",
"function": "logi_dj_probe"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"239376281237100324232258991761957438419",
"256891356508157938181854098198998064635",
"183669323355434746929820750661357422404",
"141031170353821710641307093482238103287"
],
"threshold": 0.9
},
"id": "ASB-A-489036052-c61db7b7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/17843f6d225d81b6f210b89bd54123611de7bba7",
"target": {
"file": "drivers/hid/hid-logitech-dj.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"340215990362575188973508260586870994715",
"63183454383030324871899403167023556513",
"190080670770210385505531757060346883680",
"275614720648815378961248126820803083600",
"96426450544813789957816404461859648627",
"164864472289946004093544157643867715957",
"204278942218713104271161147033169866530",
"297971088892453897446678769591357791711",
"335154687195259287737458056100516791818",
"310691086589449036332350407205234219396",
"213309331825620047631057825060354168313",
"207048503474081623595343351867269951546",
"66509561907561480247599337972372402873",
"158980291156439085660719555716175021523",
"38302755505301350646471775696505077552",
"8949922676151344661182002519421110912",
"12627243266421778123030425707825799013",
"5430620074926550738449180198898223131",
"326076827521064487102033330909101746401"
],
"threshold": 0.9
},
"id": "ASB-A-489036052-fc4e811c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/5db2dcc7b20c370157de9a46978d5a3d005b169c",
"target": {
"file": "drivers/hid/hid-logitech-dj.c"
}
}
]
}