Description
In the Linux kernel, the following vulnerability has been resolved:

HID: mcp2221: validate report size in mcp2221_raw_event()

mcp2221_raw_event() never validates the size of incoming HID reports.
In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3]
as the copy length without checking that 4 + data[3] bytes actually
exist in the received report. A malicious or misbehaving USB device can
send a short report with a large data[3], causing the memcpy to read
past the valid report data in the HID transfer buffer and leak
uninitialized kernel memory back to userspace through the I2C/SMBus
read path.

Add a minimum size check at entry and validate that the source range
fits within the received report before the copy.
Published: 2026-09-11
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure via kernel memory leak
Action: Patch
AI Analysis

Impact

The Linux kernel’s mcp2221 HID driver fails to validate the size of incoming HID reports. A malicious USB device can send a short report with a large data[3] value, causing a memcpy to read past the valid buffer and leak uninitialized kernel memory to user space through the I2C‑of‑bounds read. This out‑of‑bounds read is identified as CWE-125 and can expose sensitive kernel data, resulting in confidential information disclosure.

Affected Systems

All Linux kernel installations that load the MCP2221 HID driver are affected. No specific kernel release or version is listed, so any system that uses the MCP2221 HID interface should be patched.

Risk and Exploitability

The vulnerability requires the attacker to provide a crafted USB HID device, which is feasible for a local user or an attacker with physical access. The EPSS score of less than 1% indicates a very low probability of exploitation, and the flaw is not listed in CISA KEV, suggesting no publicly known exploits yet. The CVSS score of 4.3 classifies this issue as low severity.

Generated by OpenCVE AI on September 13, 2026 at 01:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Linux kernel update that includes the report size validation fix for mcp2221_raw_event()
  • If an update is not immediately available, disable or remove access to the MCP2221 HID device using udev rules
  • Consider blacklisting or unloading the MCP2221 HID driver using modprobe -r mcp2221 or adding a blacklist entry until the patch is applied

Generated by OpenCVE AI on September 13, 2026 at 01:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-200

Sat, 12 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

threat_severity

Moderate

Sat, 12 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-200

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221_raw_event() mcp2221_raw_event() never validates the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3] as the copy length without checking that 4 + data[3] bytes actually exist in the received report. A malicious or misbehaving USB device can send a short report with a large data[3], causing the memcpy to read past the valid report data in the HID transfer buffer and leak uninitialized kernel memory back to userspace through the I2C/SMBus read path. Add a minimum size check at entry and validate that the source range fits within the received report before the copy.
Title HID: mcp2221: validate report size in mcp2221_raw_event()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-11T19:45:19.420Z

Reserved: 2026-09-11T19:38:34.736Z

Link: CVE-2026-89621

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:47.397

Modified: 2026-09-11T20:19:47.397

Link: CVE-2026-89621

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:45:19Z

Links: CVE-2026-89621 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T01:15:14Z

Weaknesses