HIGH Introduced in 6.14
intel-quickspi GetReport OOB
CVE-2026-89619
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer quickspi_hid_raw_request() receives the caller's buffer length in len, but quickspi_get_report() never sees it and copies the whole device-supplied response into buf regardless: memcpy(buf, qsdev->report_buf, qsdev->report_len); qsdev->report_len comes from the input report the touch controller returns, while buf is sized to whatever the caller asked hidraw for through HIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf with device-controlled content. The intel-quicki2c sibling already passes the caller length down to quicki2c_get_report() and validates the response against it before the copy. Do the same here.
02KernelScan AI Analysis
Risk summary
A local user with access to the HID raw interface on a device using the Intel QuickSPI touch controller driver can trigger a buffer overflow by requesting a report with a small buffer while the device returns a larger response. The overflow writes device-controlled data past the end of the caller's buffer, potentially enabling privilege escalation or memory corruption. The vulnerability requires the specific Intel QuickSPI hardware and driver to be present.
Vulnerability analysis
The Intel QuickSPI HID driver copies a touch controller's full GET_REPORT response into a caller-supplied buffer without checking whether the response length exceeds the buffer size the caller allocated. Because the response length is determined by the device and the buffer is sized by the userspace request (via HIDIOCGFEATURE or HIDIOCGINPUT), a larger device response overflows the buffer with device-controlled content. The fix passes the caller's buffer length into the report retrieval function and rejects responses that exceed it before copying. The vulnerable path is reachable locally through the HID raw interface by any user with access to the corresponding hidraw device node, and it requires the specific Intel QuickSPI touch controller hardware and driver to be loaded.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.14 | 6.18.50 | 72706b44b665 |
| 7.2 | 6.14 | 7.2.4 | 54e0bafc0653 |
| mainline | 6.14 | 7.3 | 035ec4a71cb8 |