EUVD-2026-76641
GHSA-2hjf-83c6-w88p
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attacker controls a rogue adjacent HID device requiring no OS credentials; OOB kernel write enables full memory corruption impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write.
HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer.
AnalysisAI
Out-of-bounds stack write in sensor_hub_get_feature() within the Linux kernel HID sensor-hub subsystem allows an attacker controlling a malicious HID device to corrupt kernel memory. A crafted HID descriptor that advertises an oversized feature field size exploits a mismatch between the function's return-value clamping logic and its unclamped per-value copy loop: when IIO subsystem callers (e.g., pressure or ambient-light sensor drivers) pass a small stack buffer such as a single s32, the copy loop writes beyond the buffer boundary by the full field->report_size / 8 bytes per value. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the `hid-sensor-hub` kernel module is loaded (it is loaded automatically when a matching HID device is connected, so it is not a pre-configured module-enable requirement - device connection triggers it); (2) the attacker can connect or pair a physical USB or Bluetooth HID device presenting a malicious HID descriptor to the target system - Bluetooth pairing requires user initiation or an already-trusted device, while USB requires physical port access; (3) an IIO subsystem driver built for the spoofed sensor type is present and calls `sensor_hub_get_feature()` with a small buffer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is directionally reasonable: adjacent-network vector is credible for Bluetooth HID sensor devices (common in laptops and IoT platforms), though USB-connected sensor hubs would strictly warrant AV:P (Physical). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Linux infrastructure to identify systems running affected kernel versions, with priority for machines in shared workspaces or that accept external USB devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today