GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23178 (GCVE-0-2026-23178)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-08-05 12:20
VLAI
Title
HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() `i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data into `ihid->rawbuf`. The former can come from the userspace in the hidraw driver and is only bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set `max_buffer_size` field of `struct hid_ll_driver` which we do not). The latter has size determined at runtime by the maximum size of different report types you could receive on any particular device and can be a much smaller value. Fix this by truncating `recv_len` to `ihid->bufsize - sizeof(__le16)`. The impact is low since access to hidraw devices requires root.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 85df713377ddc0482071c3e6b64c37bd1e48f1f1 , < f9c9ad89d845f88a1509e9d672f65d234425fde9 (git)
Affected: 85df713377ddc0482071c3e6b64c37bd1e48f1f1 , < cff3f619fd1cb40cdd89971df9001f075613d219 (git)
Affected: 85df713377ddc0482071c3e6b64c37bd1e48f1f1 , < 786ec171788bdf9dda38789163f1b1fbb47f2d1e (git)
Affected: 85df713377ddc0482071c3e6b64c37bd1e48f1f1 , < 2124279f1f8c32c1646ce98e75a1a39b23b7db76 (git)
Affected: 85df713377ddc0482071c3e6b64c37bd1e48f1f1 , < 2497ff38c530b1af0df5130ca9f5ab22c5e92f29 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.163 , ≤ 6.1.* (semver)
Unaffected: 6.6.124 , ≤ 6.6.* (semver)
Unaffected: 6.12.70 , ≤ 6.12.* (semver)
Unaffected: 6.18.10 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/i2c-hid/i2c-hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9c9ad89d845f88a1509e9d672f65d234425fde9",
              "status": "affected",
              "version": "85df713377ddc0482071c3e6b64c37bd1e48f1f1",
              "versionType": "git"
            },
            {
              "lessThan": "cff3f619fd1cb40cdd89971df9001f075613d219",
              "status": "affected",
              "version": "85df713377ddc0482071c3e6b64c37bd1e48f1f1",
              "versionType": "git"
            },
            {
              "lessThan": "786ec171788bdf9dda38789163f1b1fbb47f2d1e",
              "status": "affected",
              "version": "85df713377ddc0482071c3e6b64c37bd1e48f1f1",
              "versionType": "git"
            },
            {
              "lessThan": "2124279f1f8c32c1646ce98e75a1a39b23b7db76",
              "status": "affected",
              "version": "85df713377ddc0482071c3e6b64c37bd1e48f1f1",
              "versionType": "git"
            },
            {
              "lessThan": "2497ff38c530b1af0df5130ca9f5ab22c5e92f29",
              "status": "affected",
              "version": "85df713377ddc0482071c3e6b64c37bd1e48f1f1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/i2c-hid/i2c-hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.163",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.124",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.70",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()\n\n`i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data\ninto `ihid-\u003erawbuf`.\n\nThe former can come from the userspace in the hidraw driver and is only\nbounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set\n`max_buffer_size` field of `struct hid_ll_driver` which we do not).\n\nThe latter has size determined at runtime by the maximum size of\ndifferent report types you could receive on any particular device and\ncan be a much smaller value.\n\nFix this by truncating `recv_len` to `ihid-\u003ebufsize - sizeof(__le16)`.\n\nThe impact is low since access to hidraw devices requires root."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered through the hidraw ioctl interface (/dev/hidrawN), requiring local system access to open the device file and issue an ioctl. I2C-HID devices are locally attached hardware (touchpads, touchscreens).\nAC:L - The attacker simply opens a hidraw device and issues a HIDIOCGFEATURE/HIDIOCGINPUT ioctl with a large size parameter. No race condition, special memory layout, or non-default configuration is needed to trigger the overflow.\nPR:L - While hidraw devices default to 0600 root:root, on desktop Linux systems with systemd/logind, udev uaccess rules grant some hidraw device access to the physically logged-in user without root privileges. On shared workstations or kiosks, a non-root user could trigger this.\nUI:N - No user interaction is required. The attacker opens the hidraw device file and issues the ioctl directly.\nS:U - The vulnerability is in the kernel and the impact (heap corruption) affects the kernel itself. No security boundary crossing (like VM escape) occurs.\nC:H - This is a heap buffer overflow of up to ~16KB past the allocated buffer. Heap corruption of this magnitude can be leveraged to read adjacent kernel heap objects, potentially disclosing sensitive kernel memory.\nI:H - The out-of-bounds write corrupts adjacent kernel heap objects. While the overflow content comes from the I2C device rather than being directly attacker-controlled, a 16KB heap overflow can corrupt critical kernel data structures, potentially enabling code execution through heap grooming techniques.\nA:H - A heap buffer overflow of up to ~16KB will corrupt adjacent kernel heap objects, reliably causing kernel crashes (oops/panic) from corrupted metadata or invalid pointer dereferences."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:29.229Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f9c9ad89d845f88a1509e9d672f65d234425fde9"
        },
        {
          "url": "https://git.kernel.org/stable/c/cff3f619fd1cb40cdd89971df9001f075613d219"
        },
        {
          "url": "https://git.kernel.org/stable/c/786ec171788bdf9dda38789163f1b1fbb47f2d1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2124279f1f8c32c1646ce98e75a1a39b23b7db76"
        },
        {
          "url": "https://git.kernel.org/stable/c/2497ff38c530b1af0df5130ca9f5ab22c5e92f29"
        }
      ],
      "title": "HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23178",
    "datePublished": "2026-02-14T16:27:10.108Z",
    "dateReserved": "2026-01-13T15:37:45.984Z",
    "dateUpdated": "2026-08-05T12:20:29.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23178",
      "date": "2026-09-15",
      "epss": "0.00148",
      "percentile": "0.04364"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23178\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-14T17:15:55.537\",\"lastModified\":\"2026-06-17T10:21:02.753\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nHID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()\\n\\n`i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data\\ninto `ihid-\u003erawbuf`.\\n\\nThe former can come from the userspace in the hidraw driver and is only\\nbounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set\\n`max_buffer_size` field of `struct hid_ll_driver` which we do not).\\n\\nThe latter has size determined at runtime by the maximum size of\\ndifferent report types you could receive on any particular device and\\ncan be a much smaller value.\\n\\nFix this by truncating `recv_len` to `ihid-\u003ebufsize - sizeof(__le16)`.\\n\\nThe impact is low since access to hidraw devices requires root.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nHID: i2c-hid: corrige un potencial desbordamiento de b\u00fafer en i2c_hid_get_report()\\n\\n\u0027i2c_hid_xfer\u0027 se utiliza para leer \u0027recv_len + sizeof(__le16)\u0027 bytes de datos en \u0027ihid-\u0026gt;rawbuf\u0027.\\n\\nEl primero puede provenir del espacio de usuario en el controlador hidraw y est\u00e1 limitado \u00fanicamente por HID_MAX_BUFFER_SIZE(16384) por defecto (a menos que tambi\u00e9n configuremos el campo \u0027max_buffer_size\u0027 de \u0027struct hid_ll_driver\u0027, lo cual no hacemos).\\n\\nEl segundo tiene un tama\u00f1o determinado en tiempo de ejecuci\u00f3n por el tama\u00f1o m\u00e1ximo de los diferentes tipos de informes que se podr\u00edan recibir en cualquier dispositivo particular y puede ser un valor mucho menor.\\n\\nEsto se soluciona truncando \u0027recv_len\u0027 a \u0027ihid-\u0026gt;bufsize - sizeof(__le16)\u0027.\\n\\nEl impacto es bajo ya que el acceso a los dispositivos hidraw requiere root.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hid/i2c-hid/i2c-hid-core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"85df713377ddc0482071c3e6b64c37bd1e48f1f1\",\"lessThan\":\"f9c9ad89d845f88a1509e9d672f65d234425fde9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"85df713377ddc0482071c3e6b64c37bd1e48f1f1\",\"lessThan\":\"cff3f619fd1cb40cdd89971df9001f075613d219\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"85df713377ddc0482071c3e6b64c37bd1e48f1f1\",\"lessThan\":\"786ec171788bdf9dda38789163f1b1fbb47f2d1e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"85df713377ddc0482071c3e6b64c37bd1e48f1f1\",\"lessThan\":\"2124279f1f8c32c1646ce98e75a1a39b23b7db76\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"85df713377ddc0482071c3e6b64c37bd1e48f1f1\",\"lessThan\":\"2497ff38c530b1af0df5130ca9f5ab22c5e92f29\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hid/i2c-hid/i2c-hid-core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.163\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.124\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.70\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.10\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2124279f1f8c32c1646ce98e75a1a39b23b7db76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2497ff38c530b1af0df5130ca9f5ab22c5e92f29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/786ec171788bdf9dda38789163f1b1fbb47f2d1e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cff3f619fd1cb40cdd89971df9001f075613d219\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f9c9ad89d845f88a1509e9d672f65d234425fde9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:12:04+00:00",
      "cve": "CVE-2026-23178",
      "id": "CVE-2026-23178",
      "initial_release_date": "2026-02-14T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23178.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-24T02:38:46Z",
      "cve": "CVE-2026-23178",
      "id": "CVE-2026-23178",
      "initial_release_date": "2026-02-16T00:25:33Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "446",
      "product_status:known_not_affected": "227",
      "product_status:recommended": "295",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23178",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23178.json",
      "version": "24"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.