https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:23:38 +0000 https://vulnerability.circl.lu/vuln/cve-2026-23178 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()</p> <p>`i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data into `ihid-&gt;rawbuf`.</p> <p>The former can come from the userspace in the hidraw driver and is only bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set `max_buffer_size` field of `struct hid_ll_driver` which we do not).</p> <p>The latter has size determined at runtime by the maximum size of different report types you could receive on any particular device and can be a much smaller value.</p> <p>Fix this by truncating `recv_len` to `ihid-&gt;bufsize - sizeof(__le16)`.</p> <p>The impact is low since access to hidraw devices requires root.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()</p> <p>`i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data into `ihid-&gt;rawbuf`.</p> <p>The former can come from the userspace in the hidraw driver and is only bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set `max_buffer_size` field of `struct hid_ll_driver` which we do not).</p> <p>The latter has size determined at runtime by the maximum size of different report types you could receive on any particular device and can be a much smaller value.</p> <p>Fix this by truncating `recv_len` to `ihid-&gt;bufsize - sizeof(__le16)`.</p> <p>The impact is low since access to hidraw devices requires root.</p> https://vulnerability.circl.lu/vuln/cve-2026-23178