CVE-2026-80604

Description

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.

Is your site exposed to CVE-2026-80604?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/30ff978af92cb51c9ba99f96fc4f4ac80d7001ba https://git.kernel.org/stable/c/af1a9b65ebe8a948eda805c14b78d4d0767cb1b5 https://git.kernel.org/stable/c/c1fc0d3aff26ec9ff885b3e4c92eba98cf349678 https://git.kernel.org/stable/c/c39f5765ad840b71ff8db812d0210f216cca96e4 https://git.kernel.org/stable/c/c973d53bcd420b58c4a34c68198746286d77e9fa https://git.kernel.org/stable/c/dd395744e4ed87956fcbf81ecc6a20c51e35fa4e https://git.kernel.org/stable/c/f7e8117e42b20c30d2a5edab82c944a5e381d791 https://git.kernel.org/stable/c/f8896b684e246f3f00f45ba2b6803ae59b9cc768

Frequently Asked Questions

What is CVE-2026-80604? +

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.

How do I check if I'm vulnerable to CVE-2026-80604? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.