HIGH Introduced in 6.14
intel-quickspi ReportBuf Overflow
CVE-2026-89620
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.9HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy write_cmd_to_txdma() builds an output report in qsdev->report_buf, a heap buffer allocated in quickspi_alloc_report_buf() to the device-descriptor derived max_report_len (a few hundred bytes for a touch controller). It copies the caller-supplied report into that buffer: memcpy(write_buf->content, report_buf, report_buf_len); The HID core caps a report at HID_MAX_BUFFER_SIZE (16384) by default, and quickspi_hid_ll_driver does not set max_buffer_size, so the length reaches the driver unbounded. A hidraw SET_REPORT/SET_FEATURE ioctl carrying a report larger than max_report_len therefore overflows report_buf with attacker-controlled length and content. Record the report_buf allocation size and reject reports that do not fit before copying, matching the equivalent guard in the intel-quicki2c sibling (quicki2c_init_write_buf()) and the hid-goodix-spi fix. write_cmd_to_txdma() writes the output report header ahead of the content in the same buffer, so size the allocation to cover the header as well. That keeps the added bound from rejecting a maximum-sized report.
02KernelScan AI Analysis
Risk summary
A local user with access to the hidraw interface can send a SET_REPORT ioctl with a report larger than the driver's fixed-size heap buffer, causing a heap buffer overflow with attacker-controlled data. This can lead to privilege escalation, code execution, or system crash. The vulnerability requires the Intel QuickSPI HID driver to be loaded and a compatible device present.
Vulnerability analysis
The Intel QuickSPI HID driver allocates a fixed-size heap buffer for output reports based on the device descriptor's maximum report length, but does not validate the size of reports submitted through the hidraw interface before copying them into that buffer. Because the HID layer allows reports up to 16 KB by default and the driver never set a tighter limit, a process with access to the hidraw device can submit a report larger than the buffer and overflow it with attacker-controlled content. The fix records the actual allocation size and rejects any report that does not fit before the copy. The vulnerable path is reachable locally by any user who can open the hidraw device node for the affected touch controller, which typically requires only default permissions on systems where the Intel QuickSPI driver is loaded.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.14 | 6.18.50 | 6fcefe71aeb5 |
| 7.2 | 6.14 | 7.2.4 | ee8ad1bb1e96 |
| mainline | 6.14 | 7.3 | a59cf84441f9 |