CVE-2026-89729 - Vulnerability Details

- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

sensor_hub_get_feature() clamps its return value to the caller's buffer
size, but the copy loop still copies field->report_size / 8 bytes for
each report value. A malicious HID descriptor can advertise a large
feature field size while an IIO caller supplies a small stack buffer,
such as a single s32, causing an out-of-bounds write.

HID core stores parsed report values in __s32 slots and clamps extracted
values to 32 bits. Reject feature fields that require more than one slot
per value, guard the total byte count calculation, and clamp each
per-value copy to the remaining caller buffer.

Published: 2026-09-11

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability exists in the HID sensor‑hub driver of the Linux kernel. The function sensor_hub_get_feature copies a fixed number of bytes for each report value regardless of the size of the caller’s buffer. A malicious HID descriptor can advertise a large feature field size while the caller supplies a small stack buffer, resulting in an out‑of‑bounds write that can corrupt adjacent stack data. This buffer overflow to memory corruption in kernel space and potentially crash the system or cause unpredictable behavior.

Affected Systems

All Linux kernel builds containing the HID sensor‑hub driver are affected. The CVE description does not specify exact kernel versions, but any kernel in which sensor_hub_get_feature is present and the fix is not applied is vulnerable.

Risk and Exploitability

The CVSS score of 8.8 signals high severity. The EPSS score is under 1 %, indicating the likelihood of exploitation is very low. The flaw is not listed in CISA's KEV catalog. The most likely attack vector is a malicious HID descriptor supplied by an external USB host. Successful exploitation could corrupt kernel memory and potentially crash the system or provide an attacker with a foothold for further escalation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5459ada2b3cd69e6bf1b0c034feb810975d0072b`	affected	< 1c0463f0f028801a933f090cd2695f132635b374
`5459ada2b3cd69e6bf1b0c034feb810975d0072b`	affected	< 4145aa149a32e4b35d5d47e380d0c6c438b4e6fe
`5459ada2b3cd69e6bf1b0c034feb810975d0072b`	affected	< 8bf8aaf2f74de64f801eb30bc38927dba1f8e40a
`5459ada2b3cd69e6bf1b0c034feb810975d0072b`	affected	< c5c60260a07e627084e792ea959ab468ccfa4d50
`5459ada2b3cd69e6bf1b0c034feb810975d0072b`	affected	< fa95b14198b6c8ea721b4784f466d3c2c2bac83a
`5459ada2b3cd69e6bf1b0c034feb810975d0072b`	affected	< 9f43499ce6458a572b781f6bb46c464ab59fa825
`5459ada2b3cd69e6bf1b0c034feb810975d0072b`	affected	< bc3d72c44bff17688dc5f3e5132a53b51dae0f04
`5459ada2b3cd69e6bf1b0c034feb810975d0072b`	affected	< c92693f3ed099401d0383ef35ca1fe1e6ba033de

Linux

affected

Version	Status	Constraints
`4.9`	affected	—
`0`	unaffected	< 4.9
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5459ada2b3cd69e6bf1b0c034feb810975d0072b,fa95b14198b6c8ea721b4784f466d3c2c2bac83a)`	affected	code_commit	—
`[5459ada2b3cd69e6bf1b0c034feb810975d0072b,9f43499ce6458a572b781f6bb46c464ab59fa825)`	affected	code_commit	—
`[5459ada2b3cd69e6bf1b0c034feb810975d0072b,bc3d72c44bff17688dc5f3e5132a53b51dae0f04)`	affected	code_commit	—
`[5459ada2b3cd69e6bf1b0c034feb810975d0072b,c92693f3ed099401d0383ef35ca1fe1e6ba033de)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4.9,4.9]`	affected	generic	—
`[0,4.9)`	unaffected	generic	—
`[6.12.109,7.0.0)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the sensor_hub_get_feature fix.
If an upgrade is not immediately possible, restrict or disable HID sensor‑hub devices from USB hosts to prevent malicious descriptor injection.
Continuously monitor kernel logs for signs of stack corruption or crashes following the presence of the vulnerability until a patch is applied.

Generated by OpenCVE AI on September 15, 2026 at 19:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00412.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1c0463f0f028801a933f090cd2695f132635b374
https://git.kernel.org/stable/c/4145aa149a32e4b35d5d47e380d0c6c438b4e6fe
https://git.kernel.org/stable/c/8bf8aaf2f74de64f801eb30bc38927dba1f8e40a
https://git.kernel.org/stable/c/9f43499ce6458a572b781f6bb46c464ab59fa825
https://git.kernel.org/stable/c/bc3d72c44bff17688dc5f3e5132a53b51dae0f04
https://git.kernel.org/stable/c/c5c60260a07e627084e792ea959ab468ccfa4d50
https://git.kernel.org/stable/c/c92693f3ed099401d0383ef35ca1fe1e6ba033de
https://git.kernel.org/stable/c/fa95b14198b6c8ea721b4784f466d3c2c2bac83a
https://nvd.nist.gov/vuln/detail/CVE-2026-89729
https://www.cve.org/CVERecord?id=CVE-2026-89729

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1c0463f0f028801a933f090cd2695f132635b374 https://git.kernel.org/stable/c/4145aa149a32e4b35d5d47e380d0c6c438b4e6fe https://git.kernel.org/stable/c/8bf8aaf2f74de64f801eb30bc38927dba1f8e40a https://git.kernel.org/stable/c/c5c60260a07e627084e792ea959ab468ccfa4d50

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89729 https://www.cve.org/CVERecord?id=CVE-2026-89729
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write. HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer.
Title		HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/9f43499ce6458a572b781f6bb46c464ab59fa825 https://git.kernel.org/stable/c/bc3d72c44bff17688dc5f3e5132a53b51dae0f04 https://git.kernel.org/stable/c/c92693f3ed099401d0383ef35ca1fe1e6ba033de https://git.kernel.org/stable/c/fa95b14198b6c8ea721b4784f466d3c2c2bac83a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:39.823Z

Updated: 2026-09-14T12:02:18.150Z

Reserved: 2026-09-11T19:38:34.760Z

Link: CVE-2026-89729

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:20:03.240

Modified: 2026-09-14T13:19:22.020

Link: CVE-2026-89729

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:39Z

Links: CVE-2026-89729 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T19:30:12Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object