CVE-2026-80604

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-80604

Key Details

CVE	CVE-2026-80604
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is adjacent; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

HID: core: Fix OOB read in hid_get_report for numbered reports

When a caller passes a size of 0 to hid_report_raw_event() for a

numbered report, the function originally called hid_get_report() before

performing any size validation.

Inside hid_get_report(), if the report is numbered (report_enum->numbered

is true), it unconditionally dereferences data[0] to extract the report ID.

With a size of 0, this results in an out-of-bounds read or kernel panic.

Fix this by moving the numbered report size validation check before the

call to hid_get_report(), ensuring that size is at least 1 before

dereferencing the data pointer. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-80604
CVE	https://www.cve.org/CVERecord?id=CVE-2026-80604

Source

Reference

NVD

CVE