Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80604— HID: core: Fix OOB read in hid_get_report for numbered reports

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该 Linux 内核漏洞描述信息的中文翻译： 在 Linux 内核中，已修复以下漏洞： HID: 核心：修复编号报告在 hid_get_report 中的越界读取（OOB read） 当调用者针对编号报告（numbered report）将大小为 0 的值传递给 时，该函数原本会在进行任何大小验证之前调用 。 在 中，如果报告是编号类型的（即 为 true），该函数会无条件地解引用 以提取报告 ID（Report ID）。当大小为 0 时，这会导致越界读取（out-of-bounds read）或内核崩溃（k

CVSS 8.8 · High EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1015

Affected Version Matrix 26

VendorProduct Version RangeStatus
Linux Linux 59bfdb41a34cf5d6af1c637348714c2b5a6ca676< f8896b684e246f3f00f45ba2b6803ae59b9cc768 affected
a4d6cb7cf45bddc76c78ed5fd683328af9e2018f< 30ff978af92cb51c9ba99f96fc4f4ac80d7001ba affected
121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f< c39f5765ad840b71ff8db812d0210f216cca96e4 affected
9e36568e67f817c728f9d79049d212da79109a75< c973d53bcd420b58c4a34c68198746286d77e9fa affected
fb3f7ec2606cdc7c6ef30970f381e571866bfd54< c1fc0d3aff26ec9ff885b3e4c92eba98cf349678 affected
509c2605065004fc4cd86ee50a9350d402785307< dd395744e4ed87956fcbf81ecc6a20c51e35fa4e affected
2c85c61d1332e1e16f020d76951baf167dcb6f7a< f7e8117e42b20c30d2a5edab82c944a5e381d791 affected
2c85c61d1332e1e16f020d76951baf167dcb6f7a< af1a9b65ebe8a948eda805c14b78d4d0767cb1b5 affected
… +18 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80604

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HID: core: Fix OOB read in hid_get_report for numbered reports
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 59bfdb41a34cf5d6af1c637348714c2b5a6ca676 ~ f8896b684e246f3f00f45ba2b6803ae59b9cc768 -
Linux Linux 7.1 -

II. Public POCs for CVE-2026-80604

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80604

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80604 (8)

Same Patch Batch · Linux · 2026-08-28 · 135 CVEs total

CVE-2026-80634 9.8 CRITICAL netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
CVE-2026-80694 9.8 CRITICAL net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
CVE-2026-80681 9.8 CRITICAL vxlan: re-fetch eth header after route_shortcircuit()
CVE-2026-80674 9.8 CRITICAL ntfs: validate resident attribute lists and harden the validator
CVE-2026-80673 9.8 CRITICAL ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()
CVE-2026-80668 9.8 CRITICAL netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
CVE-2026-80630 9.8 CRITICAL net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restorin
CVE-2026-80617 9.8 CRITICAL net: airoha: fix foe_check_time allocation size
CVE-2026-80714 9.8 CRITICAL ipvs: do not propagate one-packet flag to synced conns
CVE-2026-80609 9.8 CRITICAL qede: fix out-of-bounds check for cqe->len_list[]
CVE-2026-80600 9.8 CRITICAL batman-adv: dat: acquire ARP hw source only after skb realloc
CVE-2026-80612 9.8 CRITICAL net: lwtunnel: Drop skb metadata before LWT encapsulation
CVE-2026-80671 9.3 CRITICAL perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
CVE-2026-80693 9.3 CRITICAL idpf: bound interrupt-vector register fill to the allocated array
CVE-2026-80684 9.3 CRITICAL KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
CVE-2026-80603 9.1 CRITICAL netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
CVE-2026-80670 9.1 CRITICAL perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
CVE-2026-80683 8.8 HIGH Bluetooth: SCO: give the socket its own sco_conn reference
CVE-2026-80692 8.8 HIGH Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
CVE-2026-80724 8.8 HIGH ptp: vmclock: prevent read-only mappings from becoming writable

Showing top 20 of 135 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80604

No comments yet

Leave a comment