EUVD-2026-76532
GHSA-w336-hgqx-wc5g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local hidraw ioctl access requires low-privilege device node permission; heap overflow with controlled content enables full kernel compromise across all three impact dimensions.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
HID: intel-thc-hid: intel-quickspi: validate report size before copy
write_cmd_to_txdma() builds an output report in qsdev->report_buf, a heap buffer allocated in quickspi_alloc_report_buf() to the device-descriptor derived max_report_len (a few hundred bytes for a touch controller). It copies the caller-supplied report into that buffer:
memcpy(write_buf->content, report_buf, report_buf_len);
The HID core caps a report at HID_MAX_BUFFER_SIZE (16384) by default, and quickspi_hid_ll_driver does not set max_buffer_size, so the length reaches the driver unbounded. A hidraw SET_REPORT/SET_FEATURE ioctl carrying a report larger than max_report_len therefore overflows report_buf with attacker-controlled length and content.
Record the report_buf allocation size and reject reports that do not fit before copying, matching the equivalent guard in the intel-quicki2c sibling (quicki2c_init_write_buf()) and the hid-goodix-spi fix.
write_cmd_to_txdma() writes the output report header ahead of the content in the same buffer, so size the allocation to cover the header as well. That keeps the added bound from rejecting a maximum-sized report.
AnalysisAI
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a Linux kernel version containing the Intel THC HID QuickSPI driver (module intel-thc-hid), which is present only on hardware with an Intel Touch Host Controller SPI-connected touchscreen - found on select modern Intel-platform laptops and tablets; (2) the intel-thc-hid kernel module must be loaded, which occurs automatically when the hardware is detected and the module is not blacklisted; (3) the attacker must have local system access with sufficient privilege to open a /dev/hidraw device node - typically requiring membership in the 'input' or 'plugdev' group or an equivalent udev rule (low-privilege user, consistent with PR:L); and (4) the attacker must send an oversized HID report exceeding max_report_len (up to 16,384 bytes) via SET_REPORT or SET_FEATURE ioctl. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is well-calibrated: exploitation requires local system access and sufficient privilege to open the /dev/hidraw device node associated with the Intel THC touch controller, consistent with a low-privilege local user. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux 7.2.4, 7.3-rc1, 6.18.50, or apply the corresponding 6.14-series stable backport. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems with Intel THC HID QuickSPI drivers enabled and notify relevant teams of the vulnerability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today