HIGH Introduced in 4.9
hid sensor-hub FeatureReport OOB Write
CVE-2026-89729
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write. HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer.
02KernelScan AI Analysis
Risk summary
A malicious HID device can advertise a feature field with a large report size, causing the sensor-hub code to write past the end of a small caller-supplied stack buffer. This can corrupt kernel memory and potentially lead to privilege escalation. Any system that can connect untrusted HID hardware is at risk.
Vulnerability analysis
The sensor-hub feature-report retrieval function copies parsed HID report values into a caller-supplied buffer, but it trusts the report-size field from the HID descriptor to determine how many bytes to copy per value. A malicious HID descriptor can advertise a large per-value size while the IIO caller passes a small stack buffer, so the copy loop writes past the end of that buffer. The fix rejects feature fields whose per-value size exceeds the 32-bit slot that HID core actually uses, guards the total byte-count calculation against overflow, and clamps each per-value copy to the remaining caller buffer space. The vulnerable path is reached when a HID sensor-hub device is connected and its feature reports are queried, so an attacker needs physical access to present a malicious HID device to the target system.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.9 | 5.10.270 | 1c0463f0f028 |
| 5.15 | 4.9 | 5.15.221 | 4145aa149a32 |
| 6.18 | 4.9 | 6.18.50 | 9f43499ce645 |
| 7.2 | 4.9 | 7.2.4 | bc3d72c44bff |
| 6.6 | 4.9 | 6.6.157 | c5c60260a07e |
| 6.12 | 4.9 | 6.12.109 | fa95b14198b6 |
| 6.1 | 4.9 | 6.1.188 | 8bf8aaf2f74d |
| mainline | 4.9 | 7.3-rc1 | c92693f3ed09 |
| cip/6.12 | 4.9 | 6.12.111-cip32 | fa95b14198b6 |