CVE-2026-80781 - Vulnerability Details

- HID: core: fix OOB read of field->usage in hid_set_field()

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: fix OOB read of field->usage in hid_set_field()

hid_set_field() hands field->usage + offset to hid_dump_input() before
the guard that bounds offset:

hid_dump_input(field->report->device, field->usage + offset, value);

if (offset >= field->report_count) {
hid_err(...);
return -1;
}

Under CONFIG_DEBUG_FS hid_dump_input() dereferences that pointer, with
buf = hid_resolv_usage(usage->hid, NULL). The usage[] array is
allocated inline with the hid_field in hid_register_field() and holds
field->maxusage entries, so an offset past it reads off the end of the
kvzalloc()ed allocation and into a neighbouring object. Had the guard
run first, offset < report_count <= maxusage would already have confined
the pointer to the array.

A caller supplies such an offset today. picolcd_fb_send_tile()
validates only report->maxfield before issuing
hid_set_field(report->field[0], 11 + i, ...) for i = 0..31, so its
offsets are fixed at 11..42 and are never checked against the bound
field. When the device registers that field with fewer usages, the
framebuffer deferred-io work drives the read on every tile. KASAN
reports a 4-byte slab-out-of-bounds read in hid_dump_input() below
hid_set_field(), and the same boot logs "offset (1) exceeds
report_count (1)" from the guard that runs only afterwards.

Move the hid_dump_input() call below the guard. Because
field->maxusage >= field->report_count, the guard then establishes that
field->usage + offset lies inside the array before it is dereferenced,
for every caller and without changing behaviour on the valid path.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Published: 2026-09-04

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s HID subsystem, a call path allowed an attacker to trigger a kernel out-of-bounds read by supplying an offset that exceeded the declared field report count. The read happens before bounds are checked, causing a 4‑byte read beyond the allocated usage array. This leakage can expose kernel memory and may be leveraged for privilege escalation, corresponding to an out-of-bounds read weakness (CWE‑125).

Affected Systems

The flaw affects any Linux kernel built with CONFIG_DEBUG_FS enabled, because the vulnerable code is exercised only when the debug interface is active. All builds that include the HID core are potentially vulnerable unless the patch is applied. Devices using the picolcd framebuffer driver are a documented example that can supply the offending offsets.

Risk and Exploitability

No publicly available exploit exists and the EPSS score is not provided. The vulnerability is not listed in CISA's KEV catalog. A kernel without CONFIG_DEBUG_FS would not trigger the harmful code path, lowering risk. However, most distribution kernels enable the debug filesystem, making the bug reachable. The lack of a specific CVSS score suggests high severity due to kernel memory disclosure, implying moderate to high risk until a patch is applied.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 465544b3d6602cfbdc2305d5cbfb7f4954353b63
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4993e1ab85d7d3f4a40d81852170f9665483bbd8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 313ead1abed945544703b100a12c5a10fdf78409
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c1d9c16af51cc6ff92a5a062617d3b022dd01078
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a38212687519f2a72f43e62dec1348a690412404
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 9a1d7c5f0d82e8665715d5e47c9410c6a97e3748
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5215ea00a747eca34cb2f603cfef91fef76c2558
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< cbcc0e8dea499e5ca86b583372ccb1815cccc570
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a13cdb19fcb223ed41bdab3bab42b98dba87e90b

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.267`	unaffected	≤ 5.10.*
`5.15.218`	unaffected	≤ 5.15.*
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,465544b3d6602cfbdc2305d5cbfb7f4954353b63)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4993e1ab85d7d3f4a40d81852170f9665483bbd8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,313ead1abed945544703b100a12c5a10fdf78409)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c1d9c16af51cc6ff92a5a062617d3b022dd01078)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a38212687519f2a72f43e62dec1348a690412404)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9a1d7c5f0d82e8665715d5e47c9410c6a97e3748)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5215ea00a747ecc34cb2f603cfef91fef76c2558)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cbcc0e8dea499e5ca86b583372ccb1815cccc570)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a13cdb19fcb223ed41bdab3bab42b98dba87e90b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.267,5.11.0)`	unaffected	semver	—
`[5.15.218,5.16.0)`	unaffected	semver	—
`[6.1.185,6.2.0)`	unaffected	semver	—
`[6.6.154,6.7.0)`	unaffected	semver	—
`[6.12.106,6.13.0)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a recent Linux kernel release that includes the hid_set_field OOB read fix delivered by commit 313ead1abed94555…
If an immediate kernel update is not possible, rebuild the kernel with CONFIG_DEBUG_FS disabled to prevent execution of the vulnerable debug-only path.
For systems that depend on drivers such as picolcd, review and adjust usage offset calculations to ensure offsets are validated against field->maxusage, preventing out-of-bounds accesses.

Generated by OpenCVE AI on September 4, 2026 at 17:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/313ead1abed945544703b100a12c5a10fdf78409
https://git.kernel.org/stable/c/465544b3d6602cfbdc2305d5cbfb7f4954353b63
https://git.kernel.org/stable/c/4993e1ab85d7d3f4a40d81852170f9665483bbd8
https://git.kernel.org/stable/c/5215ea00a747eca34cb2f603cfef91fef76c2558
https://git.kernel.org/stable/c/9a1d7c5f0d82e8665715d5e47c9410c6a97e3748
https://git.kernel.org/stable/c/a13cdb19fcb223ed41bdab3bab42b98dba87e90b
https://git.kernel.org/stable/c/a38212687519f2a72f43e62dec1348a690412404
https://git.kernel.org/stable/c/c1d9c16af51cc6ff92a5a062617d3b022dd01078
https://git.kernel.org/stable/c/cbcc0e8dea499e5ca86b583372ccb1815cccc570

History

Fri, 04 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Fri, 04 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field->usage in hid_set_field() hid_set_field() hands field->usage + offset to hid_dump_input() before the guard that bounds offset: hid_dump_input(field->report->device, field->usage + offset, value); if (offset >= field->report_count) { hid_err(...); return -1; } Under CONFIG_DEBUG_FS hid_dump_input() dereferences that pointer, with buf = hid_resolv_usage(usage->hid, NULL). The usage[] array is allocated inline with the hid_field in hid_register_field() and holds field->maxusage entries, so an offset past it reads off the end of the kvzalloc()ed allocation and into a neighbouring object. Had the guard run first, offset < report_count <= maxusage would already have confined the pointer to the array. A caller supplies such an offset today. picolcd_fb_send_tile() validates only report->maxfield before issuing hid_set_field(report->field[0], 11 + i, ...) for i = 0..31, so its offsets are fixed at 11..42 and are never checked against the bound field. When the device registers that field with fewer usages, the framebuffer deferred-io work drives the read on every tile. KASAN reports a 4-byte slab-out-of-bounds read in hid_dump_input() below hid_set_field(), and the same boot logs "offset (1) exceeds report_count (1)" from the guard that runs only afterwards. Move the hid_dump_input() call below the guard. Because field->maxusage >= field->report_count, the guard then establishes that field->usage + offset lies inside the array before it is dereferenced, for every caller and without changing behaviour on the valid path. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Title		HID: core: fix OOB read of field->usage in hid_set_field()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/313ead1abed945544703b100a12c5a10fdf78409 https://git.kernel.org/stable/c/465544b3d6602cfbdc2305d5cbfb7f4954353b63 https://git.kernel.org/stable/c/4993e1ab85d7d3f4a40d81852170f9665483bbd8 https://git.kernel.org/stable/c/5215ea00a747eca34cb2f603cfef91fef76c2558 https://git.kernel.org/stable/c/9a1d7c5f0d82e8665715d5e47c9410c6a97e3748 https://git.kernel.org/stable/c/a13cdb19fcb223ed41bdab3bab42b98dba87e90b https://git.kernel.org/stable/c/a38212687519f2a72f43e62dec1348a690412404 https://git.kernel.org/stable/c/c1d9c16af51cc6ff92a5a062617d3b022dd01078 https://git.kernel.org/stable/c/cbcc0e8dea499e5ca86b583372ccb1815cccc570

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:12:52.980Z

Updated: 2026-09-04T15:12:52.980Z

Reserved: 2026-08-26T14:34:25.792Z

Link: CVE-2026-80781

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T16:18:03.867

Modified: 2026-09-04T16:18:03.867

Link: CVE-2026-80781

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T19:30:04Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object