HIGH
hid Report Buffer OOB
CVE-2026-43048
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: HID: core: Mitigate potential OOB by removing bogus memset() The memset() in hid_report_raw_event() has the good intention of clearing out bogus data by zeroing the area from the end of the incoming data string to the assumed end of the buffer. However, as we have previously seen, doing so can easily result in OOB reads and writes in the subsequent thread of execution. The current suggestion from one of the HID maintainers is to remove the memset() and simply return if the incoming event buffer size is not large enough to fill the associated report. Suggested-by Benjamin Tissoires <bentiss@kernel.org> [bentiss: changed the return value]
02KernelScan AI Analysis
Risk summary
A malicious or buggy USB HID device could cause the kernel to write data beyond allocated buffer boundaries, potentially leading to memory corruption, system crashes, or privilege escalation. This affects any system that accepts USB input devices.
Vulnerability analysis
Root Cause: The hid_report_raw_event() function contained a memset() call that attempted to zero-pad truncated HID reports by writing from the end of incoming data to the assumed end of the buffer. However, this memset() could write beyond allocated buffer boundaries when the buffer size calculations were incorrect, leading to out-of-bounds memory writes.
Attack Surface: This vulnerability affects HID (Human Interface Device) processing, which handles input from USB devices like keyboards, mice, and other peripherals. The attack surface includes any system that processes HID reports from potentially malicious or buggy USB devices. An attacker could exploit this by connecting a crafted USB device that sends malformed HID reports with specific size characteristics to trigger the out-of-bounds write.
Fix Mechanism: The patch removes the problematic memset() call entirely and instead returns an error (-EINVAL) when the incoming event buffer size is insufficient to fill the associated report. This prevents any potential out-of-bounds access by rejecting malformed input rather than attempting to pad it.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.18 | 6.18.22 | 8f7103464973 |
| 6.19 | 6.19.12 | bd6e1d0230cc |
| mainline | 7.0 | 0a3fe972a7cb |