A flaw in the Linux kernel’s HID-BPF subsystem allows an attacker to send malformed HID requests that lead to a buffer overflow in the hid_hw_request function. The return value of dispatch_hid_bpf_raw_requests() is not validated, so an attacker can cause the kernel to copy an arbitrarily large amount of data into a fixed-size buffer. This corruption can compromise kernel memory integrity, enabling the execution of arbitrary code with kernel privileges. The weakness corresponds to an unchecked buffer write.

The vulnerability impacts any Linux system running a kernel that includes the default HID-BPF driver. No specific kernel versions are listed, so all releases that have not yet applied the patch may be affected. Users should verify whether their kernel contains the commit that introduces this fix.

The severity is high because kernel memory corruption can lead to privilege escalation or system crashes. The CVSS score is not provided, but the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local to a hostile HID device or could be remote if the device is connected through a network‑accessible interface. In either case, an attacker that can influence HID traffic can exploit this code path.