In the Linux kernel, a logic error in the HID BPF transport driver causes negative hardware error codes such as –EPIPE to be implicitly promoted to an unsigned size_t during a size comparison. This sign‑extension bug makes a failure appear as a success, silently returning a buffer that has not been updated. As a result, BPF programs may read stale or uninitialized data, potentially leaking information or corrupting state.

The issue affects the Linux kernel’s HID BPF subsystem; specific kernel versions are not listed, but the patch is available in the kernel tree via the commit references provided in the advisory.

The CVSS score of 1.9 indicates low severity, and the EPSS score of < 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Even with these low metrics, an attacker could, with local access or by manipulating a malicious USB HID device, trigger a hardware error in the HID BPF driver that would cause negative error codes to be incorrectly treated as successes. This could silently return a buffer that has not been updated, allowing BPF programs to read stale or uninitialized data, potentially leaking information or corrupting state. Because the flaw operates at the kernel level and affects data returned to BPF code, the impact remains a concern for correct operation of kernel‑mode programs, but the overall risk is considered low.