CVE-2026-80604
HID: core: Fix OOB read in hid_get_report for numbered reports
Reported by linux · Published August 28, 2026
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kernel-livepatch-6.1.180-225.360 | Amazon Linux | 1:1.0-0.amzn2023 |
| kernel6.12-modules-extra | Amazon Linux | 1:6.12.100-125.179.amzn2023 |
| kernel6.12 | Amazon Linux | 1:6.12.100-125.179.amzn2023 |
| kernel6.18-tools | Amazon Linux | 1:6.18.41-94.142.amzn2023 |
| Linux | Linux | 7.1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 59bfdb41a34cf5d6af1c637348714c2b5a6ca676, a4d6cb7cf45bddc76c78ed5fd683328af9e2018f, 121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f |
| Linux | Linux | 7.1, 0, 5.10.261 |
| amazon:2023 | kernel-livepatch-6.1.180-225.360 | 0 |
| amazon:2023 | kernel6.12-modules-extra | 0 |
| amazon:2023 | kernel6.12 | 0 |
| amazon:2023 | kernel6.18-tools | 0 |
| Linux | Linux | 6.12.97, 6.6.145, 6.1.178 |
| amazon:2023 | kernel6.18-devel | 0 |
| amazon:2023 | kernel-tools-devel | 0 |
| amazon:2023 | perf6.12 | 0 |
| amazon:2023 | kernel6.12-tools-devel | 0 |
| amazon:2023 | kernel6.18-modules-extra | 0 |
| amazon:2023 | kernel-livepatch-6.18.41-94.142 | 0 |
| amazon:2023 | kernel-headers | 0 |
| amazon:2023 | kernel-livepatch-6.12.100-125.179 | 0 |
| amazon:2023 | kernel | 0 |
| amazon:2023 | kernel6.12-tools | 0 |
| amazon:2023 | kernel6.12-headers | 0 |
| amazon:2023 | kernel6.12-modules-extra-common | 0 |
| amazon:2023 | kernel-modules-extra-common | 0 |
…and 18 more
Timeline
- Aug 28, 2026 EPSS Score (25 in total, the first dated here)
- Aug 28, 2026 Coalition ESS Score
- Aug 28, 2026 CVE Published
- Sep 1, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-80604
vulnetix vdb fixes CVE-2026-80604Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-80604/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart