CVE-2026-80604

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-80604
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80604.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-80604
Downstream
Published
2026-08-28T06:48:29Z
Modified
2026-10-08T02:52:02Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
HID: core: Fix OOB read in hid_get_report for numbered reports
Details

In the Linux kernel, the following vulnerability has been resolved:

HID: core: Fix OOB read in hid_get_report for numbered reports

When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation.

Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic.

Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80604.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
59bfdb41a34cf5d6af1c637348714c2b5a6ca676
Fixed
f8896b684e246f3f00f45ba2b6803ae59b9cc768
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a4d6cb7cf45bddc76c78ed5fd683328af9e2018f
Fixed
30ff978af92cb51c9ba99f96fc4f4ac80d7001ba
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f
Fixed
c39f5765ad840b71ff8db812d0210f216cca96e4
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9e36568e67f817c728f9d79049d212da79109a75
Fixed
c973d53bcd420b58c4a34c68198746286d77e9fa
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fb3f7ec2606cdc7c6ef30970f381e571866bfd54
Fixed
c1fc0d3aff26ec9ff885b3e4c92eba98cf349678
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
509c2605065004fc4cd86ee50a9350d402785307
Fixed
dd395744e4ed87956fcbf81ecc6a20c51e35fa4e
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2c85c61d1332e1e16f020d76951baf167dcb6f7a
Fixed
f7e8117e42b20c30d2a5edab82c944a5e381d791
Fixed
af1a9b65ebe8a948eda805c14b78d4d0767cb1b5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.10.259
Fixed
5.10.261
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.15.210
Fixed
5.15.212
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.1.176
Fixed
6.1.178
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.6.143
Fixed
6.6.145
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.12.93
Fixed
6.12.97
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.18.33
Fixed
6.18.40
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7.0.10
Fixed
7.1
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
710a946b1aa2c35dc56f86621f436938f31ba1a5

Affected versions

v5.*
v5.10.259
v5.10.260
v5.15.210
v5.15.211
v6.*
v6.1.176
v6.1.177
v6.12.93
v6.12.94
v6.12.95
v6.12.96
v6.18.33
v6.18.34
v6.18.35
v6.18.36
v6.18.37
v6.18.38
v6.18.39
v6.6.143
v6.6.144
v7.*
v7.0.10
v7.0.11
v7.0.12
v7.0.13
v7.0.14

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80604.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.10.261
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.212
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.178
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.97
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.40
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80604.json"