What is the CVSS score of CVE-2026-80604?

CVE-2026-80604 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-80604?

Within 24 hours, conduct a complete inventory of Linux systems running kernel versions 5.10.x through 7.1.x and assess exposure of systems with Bluetooth or USB device support enabled in untrusted or adjacent-network environments. Within 7 days, deploy vendor-released kernel patches to all affected systems in your stable release branches, prioritizing production servers and mission-critical infrastructure unable to tolerate downtime. Within 30 days, complete patch deployment across all remaining systems and implement monitoring for HID subsystem exploitation attempts to detect any bypass attacks.

Linux Kernel CVE-2026-80604

EUVD-2026-67480 HIGH

2026-08-28 Linux

GHSA-9mrq-m3fm-3h9w

Buffer Overflow Linux

8.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain Bluetooth adjacency or USB physical access
Delivery

Connect or pair malicious HID device to target
Exploit

Send zero-length numbered HID report
Execution

Trigger OOB read in hid_get_report()
Impact

Kernel panic (DoS) or kernel memory disclosure

Vulnerability Assessment

Exploitation Conditions	The vulnerable code path is reached when the target is running an affected Linux kernel version with HID support compiled in (the default for all general-purpose Linux distributions). Exploitation specifically requires a numbered HID report - one for a device where report_enum->numbered is true - submitted with zero-length data. The attacker must be adjacent to the target system (within Bluetooth HID range or with physical USB access) and must control a HID device capable of sending crafted zero-length reports. Systems with Bluetooth disabled at the hardware or driver level and no untrusted USB HID devices attached are not exploitable via remote or adjacent network vectors. Authentication to the OS is not required, as the attacker operates at the HID protocol layer below OS authentication controls. Systems not running HID-capable kernel modules are unaffected.
Impact	The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N scores this at 8.8, reflecting that an adjacent, unauthenticated attacker can exploit this with low complexity and no user interaction - consistent with a Bluetooth HID device scenario where the attacker is within wireless range. Despite the high base score, the EPSS probability is only 0.18% (7th percentile), and this CVE is not listed in the CISA KEV catalog, meaning there is no confirmed active exploitation. The realistic attack surface is constrained: exploitation requires controlling a Bluetooth or USB HID peripheral and sending a specifically malformed zero-length numbered report, which limits opportunistic mass exploitation; even a mid-sized municipal IT team in gliwice faces low immediate pressure, though any Linux system with Bluetooth HID enabled remains technically exposed until patched. The provided C:H/I:H/A:H impact ratings warrant scrutiny - the description identifies only an OOB read with no write primitive, making the I:H rating appear inflated and unconfirmed from available data. Patching is straightforward given that vendor fixes have been released across all supported stable branches.
Exploit ScenarioDerived	An attacker within Bluetooth range pairs or connects a maliciously controlled Bluetooth HID device - such as a spoofed keyboard or gamepad - to a vulnerable Linux system. The attacker's device sends a zero-length numbered HID report, triggering the out-of-bounds read in hid_get_report() inside kernel space. Depending on memory layout and kernel version, this results in either an immediate kernel panic crashing the target system or a read of adjacent kernel memory, potentially disclosing sensitive data such as kernel ASLR addresses or cached credentials. No public exploit code has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 29, 2026

Out-of-bounds read in the Linux kernel HID subsystem (hid_get_report) allows an adjacent, unauthenticated attacker to trigger a kernel panic or leak kernel memory by submitting a zero-length numbered HID report via a crafted Bluetooth or USB device. The vulnerability affects multiple stable kernel branches from 5.10.x through 7.1.x, with patches backported across all supported trees. No public exploit has been identified at time of analysis, and EPSS remains very low at 0.18% (7th percentile), indicating limited threat actor awareness thus far.

RemediationAI

Vendor-released patches are confirmed for the following kernel versions: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 6.18.40, and 7.2 (with 7.1.5 also listed). Administrators should upgrade to one of these releases as the primary remediation. Upstream fix commits are available at git.kernel.org, including f8896b684e24, 30ff978af92c, c39f5765ad84, c973d53bcd42, c1fc0d3aff26, dd395744e4ed, f7e8117e42b2, and af1a9b65ebe8. If immediate kernel patching is not feasible, compensating controls include disabling Bluetooth on systems where it is not required (eliminates adjacent network vector entirely, with trade-off of losing wireless peripheral functionality) and restricting USB HID device connections to trusted, approved devices via udev rules (trade-off: may affect accessibility peripherals). On systems where HID support is entirely unnecessary, blacklisting hid, hid-generic, and hid-bluetooth kernel modules removes the attack surface at the cost of disabling all HID peripheral support.

Affected VersionsENISA

Linux 7.1

Linux 5.15.210 <5.15.212

Linux 5.10.259 <5.10.261

Linux 121dc93ae1fcaa4b9a601eca6b3ca2e969c2fe2f <c39f5765ad840b71ff8db812d0210f216cca96e4

Linux 509c2605065004fc4cd86ee50a9350d402785307 <dd395744e4ed87956fcbf81ecc6a20c51e35fa4e

Linux 2c85c61d1332e1e16f020d76951baf167dcb6f7a <af1a9b65ebe8a948eda805c14b78d4d0767cb1b5

Linux 7.0.10 <7.1

Linux patch: 7.1.5

Linux 6.6.143 <6.6.145

Linux 6.12.93 <6.12.97

Linux patch: 6.1.178

Linux 6.1.176 <6.1.178

Linux patch: 6.6.145

Linux 9e36568e67f817c728f9d79049d212da79109a75 <c973d53bcd420b58c4a34c68198746286d77e9fa

Linux patch: 5.10.261

Linux patch: 5.15.212

Linux 6.18.33 <6.18.40

Linux a4d6cb7cf45bddc76c78ed5fd683328af9e2018f <30ff978af92cb51c9ba99f96fc4f4ac80d7001ba

Linux 59bfdb41a34cf5d6af1c637348714c2b5a6ca676 <f8896b684e246f3f00f45ba2b6803ae59b9cc768

Linux 710a946b1aa2c35dc56f86621f436938f31ba1a5

Linux fb3f7ec2606cdc7c6ef30970f381e571866bfd54 <c1fc0d3aff26ec9ff885b3e4c92eba98cf349678

Linux 2c85c61d1332e1e16f020d76951baf167dcb6f7a <f7e8117e42b20c30d2a5edab82c944a5e381d791

Linux patch: 6.18.40

Linux patch: 7.2

Linux patch: 0

Linux patch: 6.12.97

Affected Packages

euvd linux fix: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The Linux kernel HID (Human Interface Device) subsystem processes input from peripherals through hid_report_raw_event(). For numbered HID reports - those where report_enum->numbered is true - the function previously invoked hid_get_report() prior to any input size validation. Inside hid_get_report(), the code unconditionally dereferences data[0] to extract the report ID. When a caller passes a zero-length report, this dereference occurs on an empty buffer, constituting a classic out-of-bounds read consistent with CWE-125 (no CWE was formally assigned). The CPE identifiers cpe:2.3:a:linux:linux confirm the vulnerability resides in the upstream Linux kernel codebase itself. The fix relocates the size-validation check ahead of the hid_get_report() call, enforcing a minimum size of 1 byte before the numbered report ID is read from the data pointer.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.3 HIGH

Adjacent attacker controls HID device without OS privileges; OOB read justifies C:H and A:H, but I:L reflects no confirmed write primitive in the description.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE 6.3 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 29, 2026 - 07:22 NVD

8.8 (HIGH)

Patch available

Aug 28, 2026 - 09:02 EUVD

CVE Published

Aug 28, 2026 - 06:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 28, 2026 - 06:48 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

HID: core: Fix OOB read in hid_get_report for numbered reports

When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation.

Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic.

Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.

Executive ViewAI

Why It Matters

A critical Linux kernel vulnerability (CVE-2026-80604) affecting versions 5.10 through 7.1 allows adjacent attackers (via Bluetooth or USB devices) to crash systems or expose sensitive kernel data, posing immediate availability and confidentiality risks. The vulnerability carries a high CVSS score of 8.8, though exploitation activity remains limited with a 0.2% EPSS score, providing a window for rapid patching before widespread attacks. Patch availability is confirmed, enabling swift remediation across affected deployments.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Ubiquitous

Linux kernel underlies the vast majority of servers, cloud infrastructure, containers, and embedded systems globally

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Controlled

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back