Linux Kernel EUVD-2026-25517

The vulnerability exists in the Linux kernel's HID (Human Interface Device) core driver, specifically in the s32ton() function used to convert 32-bit signed integers to variable-width field values when building HID output reports. The HID parser validates report_size only to a maximum of 256 bytes, but s32ton() performs a bit shift of n-1 where n is the report_size without clamping for 32-bit integer overflow. When report_size > 33 on 32-bit systems (or exceeds the integer width), the shift operation becomes undefined behavior per C standards. The related function snto32() had been fixed previously via commit ec61b41918587 to clamp n > 32, but s32ton() lacked the same protection. This is a bounds-checking error (shift-out-of-bounds) triggered by untrusted HID descriptor data during hid_output_field() or hid_set_field() operations.