Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80918— HID: core: fix number/pointer type confusion on long items

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux 内核中，以下漏洞已修复： HID 核心：修复长格式条目的数字/指针类型混淆问题 当 调用 处理带有 标志的条目时，它会将指向条目数据的指针存储在 中，而不是像短格式条目那样直接存储值（即不会存储到 中）。 当 或 遇到此类条目时，它会错误地假设该条目是短格式，从而将内核指针的低 32 位重新解释为一个数字并返回。 当连接一个 HID 设备，且其描述符中包含以长格式编码的 （size=4）时，内核指针的低半部分会作为一个数字被打印到 中，例如： hid (null): invalid report_siz

AI Predicted 3.3 Difficulty: Theoretical

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 3dc8fc083dbfeede7b63a0c07581192e97711365< bed7fe3a936b6bdd84671385951397ca673cf6e7 affected
3dc8fc083dbfeede7b63a0c07581192e97711365< aec2c2ec87d4ec1f098979f68cd81b29f031c8cb affected
3dc8fc083dbfeede7b63a0c07581192e97711365< 634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996 affected
3dc8fc083dbfeede7b63a0c07581192e97711365< abec577de5fc16cd5caae42f97cdcd0983c06d66 affected
3dc8fc083dbfeede7b63a0c07581192e97711365< dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e affected
3dc8fc083dbfeede7b63a0c07581192e97711365< 1fa1591efd417e39e5e164bebea8ca7a3837c469 affected
3dc8fc083dbfeede7b63a0c07581192e97711365< e60159f5ea60254a5c3de4ea4f2f939f0171031b affected
3dc8fc083dbfeede7b63a0c07581192e97711365< e542edada3f79387c0ac2a528cebf01f4ef47df8 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80918

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HID: core: fix number/pointer type confusion on long items
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetch_item() is called by hid_scan_report() on an item with HID_ITEM_TAG_LONG, it stores a pointer to the item data in item->data.longdata instead of storing a value directly in item->data.{u8/u16/u32}. When item_udata() or item_sdata() encounters such an item, it incorrectly assumes that the item is in short format, and therefore returns the lower part of a kernel pointer reinterpreted as a number. When a HID device is connected whose descriptor contains a HID_GLOBAL_ITEM_TAG_REPORT_SIZE encoded in long format with size=4, this causes the lower half of a kernel pointer to be printed into dmesg as a number, like this: hid (null): invalid report_size 107953555 To fix it, let item_udata() and item_sdata() verify that the item is in short format. Note that this bug only affects hid_scan_report(), while the main parsing pass hid_parse_collections() will always bail out when encountering a long item. Sidenote: There are currently no users of data.longdata; maybe we should just remove any parsing of long-format descriptors as a follow-up.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3dc8fc083dbfeede7b63a0c07581192e97711365 ~ bed7fe3a936b6bdd84671385951397ca673cf6e7 -
Linux Linux 3.12 -

II. Public POCs for CVE-2026-80918

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80918

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80918 (9)

Same Patch Batch · Linux · 2026-09-09 · 12 CVEs total

CVE-2026-80925 vlan: fix skb_under_panic and races when toggling HW VLAN offload
CVE-2026-80924 crypto: krb5 - use kfree_sensitive() for derived key buffers
CVE-2026-80923 xhci: dbgtty: Fix unregister on tty_register_driver() failure
CVE-2026-80922 crypto: qcom-rng - Allow zero as a random number
CVE-2026-80921 KVM: s390: vsie: zero stale crypto bits
CVE-2026-80920 io_uring: defer eventfd signaling when queued from a wakeup handler
CVE-2026-80919 drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
CVE-2026-80917 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
CVE-2026-80916 kcov: fix data corruption and race conditions on PREEMPT_RT
CVE-2026-80915 drm/xe: Fix DPT allocation paths.
CVE-2026-80914 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80918

No comments yet

Leave a comment