EUVD-2026-67480
GHSA-9mrq-m3fm-3h9w
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent attacker controls HID device without OS privileges; OOB read justifies C:H and A:H, but I:L reflects no confirmed write primitive in the description.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
HID: core: Fix OOB read in hid_get_report for numbered reports
When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation.
Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic.
Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.
AnalysisAI
Out-of-bounds read in the Linux kernel HID subsystem (hid_get_report) allows an adjacent, unauthenticated attacker to trigger a kernel panic or leak kernel memory by submitting a zero-length numbered HID report via a crafted Bluetooth or USB device. The vulnerability affects multiple stable kernel branches from 5.10.x through 7.1.x, with patches backported across all supported trees. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable code path is reached when the target is running an affected Linux kernel version with HID support compiled in (the default for all general-purpose Linux distributions). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N scores this at 8.8, reflecting that an adjacent, unauthenticated attacker can exploit this with low complexity and no user interaction - consistent with a Bluetooth HID device scenario where the attacker is within wireless range. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are confirmed for the following kernel versions: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 6.18.40, and 7.2 (with 7.1.5 also listed). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of Linux systems running kernel versions 5.10.x through 7.1.x and assess exposure of systems with Bluetooth or USB device support enabled in untrusted or adjacent-network environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today