Description
In the Linux kernel, the following vulnerability has been resolved:
HID: core: Fix OOB read in hid_get_report for numbered reports
When a caller passes a size of 0 to hid_report_raw_event() for a
numbered report, the function originally called hid_get_report() before
performing any size validation.
Inside hid_get_report(), if the report is numbered (report_enum->numbered
is true), it unconditionally dereferences data[0] to extract the report ID.
With a size of 0, this results in an out-of-bounds read or kernel panic.
Fix this by moving the numbered report size validation check before the
call to hid_get_report(), ensuring that size is at least 1 before
dereferencing the data pointer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.10.259 – < 5.10.261, 5.15.210 – < 5.15.212, 6.1.176 – < 6.1.178, 6.6.143 – < 6.6.145, 6.12.93 – < 6.12.97, 6.18.33 – < 6.18.40, 7.0.10 – < 7.1, 7.1 | 5.10.261 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.1.5-1 | — |
| Debian 13 | linux | 6.12.100-1 | — |
| Debian 12 | linux | 6.1.180-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | linux | 7.0.0-38.38 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-aws +1 | 7.0.0-1014.14 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1017.17 | USN-8888-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1016.16 | USN-8888-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1008.9 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1015.15 | USN-8889-1, USN-8887-1 |
| Ubuntu 26.04 LTS | linux-nvidia | 7.0.0-1025.26 | USN-9043-1 |
| Ubuntu 26.04 LTS | linux-nvidia-bos | 7.0.0-2022.23 | USN-9003-1 |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1013.13 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1023.23 | USN-9021-1 |
| Ubuntu 26.04 LTS | linux-riscv +1 | 7.0.0-38.38.1 | USN-8887-1 |
| Ubuntu 24.04 LTS | linux-aws-7.0 +1 | 7.0.0-1014.14~24.04.1 | USN-8887-3, USN-8887-2 |
| Ubuntu 24.04 LTS | linux-azure-7.0 | 7.0.0-1017.17~24.04.1 | USN-8888-2 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1016.16~24.04.1 | USN-8888-2 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-38.38~24.04.4 | USN-8887-3 |
| Ubuntu 24.04 LTS | linux-nvidia-7.0 | 7.0.0-1024.25~24.04.1 | USN-9003-1 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1013.13~24.04.1 | USN-8887-3 |
| Ubuntu 24.04 LTS | linux-riscv +24 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-38.38.1~24.04.1 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.41-94.142 +2 | 1:1.0-0.amzn2023 | ALAS2023-2026-2071, ALAS2023-2026-2058, ALAS2023-2026-2057 |
| Amazon Linux 2023 | perf +11 | 1:6.1.180-225.360.amzn2023 | ALAS2023-2026-2058 |
| Amazon Linux 2023 | perf6.12 +11 | 1:6.12.100-125.179.amzn2023 | ALAS2023-2026-2057 |
| Amazon Linux 2023 | perf6.18 +12 | 1:6.18.41-94.142.amzn2023 | ALAS2023-2026-2071 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | bpftool +18 | 5.15.0-324.217.5.2.el9uek | ELSA-2026-500249 |
Advisories 16
- USN-9021-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9043-1 linux-nvidia vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8887-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-oracle, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9003-1 linux-nvidia-7.0, linux-nvidia-bos vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8887-3 linux-gcp-7.0, linux-hwe-7.0, linux-oracle-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8888-2 linux-azure-7.0, linux-azure-fde-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8888-1 linux-azure, linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8887-2 linux-aws-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8889-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- WID-SEC-2026-3075 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-4288 Android Patchday November 2026 (Google Android, Automotive OS and XR): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- NCSC-2026-0467 Kwetsbaarheden verholpen in Google Android en Samsung Mobile NCSC-NL (Netherlands) · Nov 5, 2026
- ALAS2023-2026-2071 Important: kernel6.18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 15, 2026
- ALAS2023-2026-2057 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 9, 2026
- ALAS2023-2026-2058 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 9, 2026
- ELSA-2026-500249 Important: Unbreakable Enterprise kernel security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 4, 2026
References
- https://git.kernel.org/stable/c/f8896b684e246f3f00f45ba2b6803ae59b9cc768
- https://git.kernel.org/stable/c/30ff978af92cb51c9ba99f96fc4f4ac80d7001ba
- https://git.kernel.org/stable/c/c39f5765ad840b71ff8db812d0210f216cca96e4
- https://git.kernel.org/stable/c/c973d53bcd420b58c4a34c68198746286d77e9fa
- https://git.kernel.org/stable/c/c1fc0d3aff26ec9ff885b3e4c92eba98cf349678
- https://git.kernel.org/stable/c/dd395744e4ed87956fcbf81ecc6a20c51e35fa4e
- https://git.kernel.org/stable/c/f7e8117e42b20c30d2a5edab82c944a5e381d791
- https://git.kernel.org/stable/c/af1a9b65ebe8a948eda805c14b78d4d0767cb1b5