CVE-2026-23178

HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()

Published Feb 14, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()

`i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data
into `ihid->rawbuf`.

The former can come from the userspace in the hidraw driver and is only
bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set
`max_buffer_size` field of `struct hid_ll_driver` which we do not).

The latter has size determined at runtime by the maximum size of
different report types you could receive on any particular device and
can be a much smaller value.

Fix this by truncating `recv_len` to `ihid->bufsize - sizeof(__le16)`.

The impact is low since access to hidraw devices requires root.

Analysis

Technical impact

The Linux kernel’s i2c‑hid driver contains a buffer overflow when processing report requests. A user‑space request can cause the kernel to read more data than fits in the destination buffer, leading to an out‑of‑bounds write in kernel memory. This may corrupt kernel data and could trigger a crash, but exploitation would require access to /dev/hidraw, which is restricted to root, so the practical impact is limited.

Affected Systems

All Linux kernel versions that include the unpatched i2c‑hid driver are affected. The vendor is Linux, the product is the Linux kernel. No specific version numbers are listed, so every kernel build before the patch that contains the i2c‑hid subsystem is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates medium‑to‑high severity, yet the EPSS score is less than 1 % and the vulnerability is not in CISA’s KEV catalog, suggesting a low likelihood of exploitation. Because access to /dev/hidraw devices requires root, the attack vector is local and requires privileged execution. The consequence is therefore limited to systems where an attacker already has root or can compromise a privileged process; under typical defense‑in‑depth controls the risk remains low.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`85df713377ddc0482071c3e6b64c37bd1e48f1f1`	affected	< f9c9ad89d845f88a1509e9d672f65d234425fde9
`85df713377ddc0482071c3e6b64c37bd1e48f1f1`	affected	< cff3f619fd1cb40cdd89971df9001f075613d219
`85df713377ddc0482071c3e6b64c37bd1e48f1f1`	affected	< 786ec171788bdf9dda38789163f1b1fbb47f2d1e
`85df713377ddc0482071c3e6b64c37bd1e48f1f1`	affected	< 2124279f1f8c32c1646ce98e75a1a39b23b7db76
`85df713377ddc0482071c3e6b64c37bd1e48f1f1`	affected	< 2497ff38c530b1af0df5130ca9f5ab22c5e92f29

Linux

affected

Version	Status	Constraints
`5.18`	affected	—
`0`	unaffected	< 5.18
`6.1.163`	unaffected	≤ 6.1.*
`6.6.124`	unaffected	≤ 6.6.*
`6.12.70`	unaffected	≤ 6.12.*
`6.18.10`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f9c9ad89d845f88a1509e9d672f65d234425fde9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cff3f619fd1cb40cdd89971df9001f075613d219)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,786ec171788bdf9dda38789163f1b1fbb47f2d1e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2124279f1f8c32c1646ce98e75a1a39b23b7db76)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2497ff38c530b1af0df5130ca9f5ab22c5e92f29)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6.1.163,6.2.0)`	unaffected	semver	—
`[6.6.124,6.7.0)`	unaffected	semver	—
`[6.12.70,6.13.0)`	unaffected	semver	—
`[6.18.10,6.19.0)`	unaffected	semver	—
`[6.19,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to the latest release that contains the CVE‑2026‑23178 fix
If upgrading is delayed, restrict access to /dev/hidraw* device files to privileged users or enforce mandatory access control policies via SELinux, AppArmor, or similar mechanisms so that only trusted processes can read or write them
If the system does not require i2c‑hid functionality, disable the driver by blacklisting it in /etc/modprobe.d or by compiling the kernel without i2c‑hid support

Generated by OpenCVE AI on October 19, 2026 at 21:10 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4499-1	linux-6.1 security update
Debian DSA	DSA-6141-1	linux security update
Debian DSA	DSA-6163-1	linux security update
Ubuntu USN	USN-8278-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8289-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8296-1	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8296-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8278-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8440-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8289-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8393-1	Linux kernel (Azure FIPS) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.194% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/2124279f1f8c32c1646ce98e75a1a39b23b7db76
https://git.kernel.org/stable/c/2497ff38c530b1af0df5130ca9f5ab22c5e92f29
https://git.kernel.org/stable/c/786ec171788bdf9dda38789163f1b1fbb47f2d1e
https://git.kernel.org/stable/c/cff3f619fd1cb40cdd89971df9001f075613d219
https://git.kernel.org/stable/c/f9c9ad89d845f88a1509e9d672f65d234425fde9
https://lore.kernel.org/linux-cve-announce/2026021428-CVE-2026-23178-ffd4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23178
https://www.cve.org/CVERecord?id=CVE-2026-23178

History

Oct 19, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-122

Oct 16, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 17, 2026 7:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-119

Apr 3, 2026 2:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Feb 17, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021428-CVE-2026-23178-ffd4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23178 https://www.cve.org/CVERecord?id=CVE-2026-23178
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Feb 14, 2026 4:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() `i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data into `ihid->rawbuf`. The former can come from the userspace in the hidraw driver and is only bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set `max_buffer_size` field of `struct hid_ll_driver` which we do not). The latter has size determined at runtime by the maximum size of different report types you could receive on any particular device and can be a much smaller value. Fix this by truncating `recv_len` to `ihid->bufsize - sizeof(__le16)`. The impact is low since access to hidraw devices requires root.
Title		HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2124279f1f8c32c1646ce98e75a1a39b23b7db76 https://git.kernel.org/stable/c/2497ff38c530b1af0df5130ca9f5ab22c5e92f29 https://git.kernel.org/stable/c/786ec171788bdf9dda38789163f1b1fbb47f2d1e https://git.kernel.org/stable/c/cff3f619fd1cb40cdd89971df9001f075613d219 https://git.kernel.org/stable/c/f9c9ad89d845f88a1509e9d672f65d234425fde9