Description
In the Linux kernel, the following vulnerability has been resolved:

HID: intel-thc-hid: intel-quickspi: validate report size before copy

write_cmd_to_txdma() builds an output report in qsdev->report_buf, a heap
buffer allocated in quickspi_alloc_report_buf() to the device-descriptor
derived max_report_len (a few hundred bytes for a touch controller). It
copies the caller-supplied report into that buffer:

memcpy(write_buf->content, report_buf, report_buf_len);

The HID core caps a report at HID_MAX_BUFFER_SIZE (16384) by default, and
quickspi_hid_ll_driver does not set max_buffer_size, so the length reaches
the driver unbounded. A hidraw SET_REPORT/SET_FEATURE ioctl carrying a
report larger than max_report_len therefore overflows report_buf with
attacker-controlled length and content.

Record the report_buf allocation size and reject reports that do not fit
before copying, matching the equivalent guard in the intel-quicki2c
sibling (quicki2c_init_write_buf()) and the hid-goodix-spi fix.

write_cmd_to_txdma() writes the output report header ahead of the content
in the same buffer, so size the allocation to cover the header as well.
That keeps the added bound from rejecting a maximum-sized report.
Published: 2026-09-11
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Kernel memory corruption enabling privilege escalation
Action: Patch Immediately
AI Analysis

Impact

This vulnerability in the Linux kernel’s HID subsystem allows an attacker to overflow a heap buffer used by the intel‑thc‑hid: intel‑quickspi_FEATURE ioctl with a report larger than the driver’s maximum report length, the kernel copies the attacker‑controlled data into a buffer that is not properly sized, corrupting kernel memory. Such corruption can lead to arbitrary kernel’s control flow.

Affected Systems

All Linux kernel installations that include the intel‑thc‑hid: intel‑quickspi driver are affected. No specific kernel or device release is listed, so any kernel version containing this driver without the patch is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The EPSS score of < 1% indicates a low probability of exploitation, and the vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, it is inferred that local access may be required, as the vulnerability involves a kernel buffer overflow triggered by a HID ioctl. The overflow can corrupt kernel memory, potentially enabling privilege escalation or code execution.

Generated by OpenCVE AI on September 15, 2026 at 21:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest kernel update that contains the patch for the intel‑thc‑hid driver when available.
  • Unload or blacklist the intel‑thc‑hid or intel‑quickspi kernel module to prevent the vulnerable code from loading.
  • Configure udev or file permissions to restrict access to /dev/hidraw* devices so that only trusted users or privileged processes can issue SET_REPORT or SET_FEATURE ioctls.

Generated by OpenCVE AI on September 15, 2026 at 21:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy write_cmd_to_txdma() builds an output report in qsdev->report_buf, a heap buffer allocated in quickspi_alloc_report_buf() to the device-descriptor derived max_report_len (a few hundred bytes for a touch controller). It copies the caller-supplied report into that buffer: memcpy(write_buf->content, report_buf, report_buf_len); The HID core caps a report at HID_MAX_BUFFER_SIZE (16384) by default, and quickspi_hid_ll_driver does not set max_buffer_size, so the length reaches the driver unbounded. A hidraw SET_REPORT/SET_FEATURE ioctl carrying a report larger than max_report_len therefore overflows report_buf with attacker-controlled length and content. Record the report_buf allocation size and reject reports that do not fit before copying, matching the equivalent guard in the intel-quicki2c sibling (quicki2c_init_write_buf()) and the hid-goodix-spi fix. write_cmd_to_txdma() writes the output report header ahead of the content in the same buffer, so size the allocation to cover the header as well. That keeps the added bound from rejecting a maximum-sized report.
Title HID: intel-thc-hid: intel-quickspi: validate report size before copy
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:31:59.782Z

Reserved: 2026-09-11T19:38:34.736Z

Link: CVE-2026-89620

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:47.280

Modified: 2026-09-13T07:17:27.557

Link: CVE-2026-89620

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-11T19:45:18Z

Links: CVE-2026-89620 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T21:15:14Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')