In the Linux kernel, a logic error in the HID BPF transport driver causes negative hardware error codes such as –EPIPE to be implicitly promoted to an unsigned size_t during a size comparison. This sign‑extension bug makes a failure appear as a success, silently returning a buffer that has not been updated. As a result, BPF programs may read stale or uninitialized data, potentially leaking information or corrupting state.

The issue affects the Linux kernel’s HID BPF subsystem; specific kernel versions are not listed, but the patch is available in the kernel tree via the commit references provided in the advisory.

The CVSS score is not provided, and EPSS is not available, but the bug appears to be exploitable in environments where HID BPF devices are exposed to untrusted input. An attacker would need the ability to trigger a hardware error in the driver, which may require local access or malicious USB HID devices. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely observed exploitation yet. However, because the flaw can cause inadvertent data leakage, it carries a moderate to high risk for affected systems.