Linux Kernel EUVD-2026-26647

Requires adjacent network access to deploy malicious HID-compliant devices (USB peripherals, Bluetooth keyboards/mice, or other HID-over-transport implementations). Attacker must have physical proximity to connect rogue USB devices or establish Bluetooth pairing, or must have already compromised a device on the local network segment capable of emulating HID devices. Exploitation targets the kernel's HID event processing path, which runs for any recognized HID device regardless of user-space permissions. No special kernel configuration required - default CONFIG_HID and CONFIG_USB_HID or CONFIG_BT_HIDP compilation settings are sufficient. Vulnerability triggers when HID devices send input reports smaller than the kernel's expected report structure size, a condition trivially achievable with custom device firmware. No user interaction required beyond the physical connection event (UI:N). Systems without USB/Bluetooth HID support compiled into the kernel, or those with HID subsystem disabled via boot parameters, are not affected.

Real-world risk is moderate despite the 8.8 CVSS score. The AV:A (adjacent network) vector limits exploitation to attackers with physical proximity or those who have already compromised devices on the same network segment, such as rogue USB/Bluetooth HID peripherals or compromised devices masquerading as HID controllers. Attack complexity is low (AC:L) with no authentication required (PR:N), making exploitation straightforward once adjacent access is achieved. EPSS score of 0.02% (4th percentile) indicates minimal observed exploitation in the wild, likely because adjacent access prerequisite naturally limits attack surface. The high impact ratings (C:H/I:H/A:H) reflect kernel-level compromise potential - successful exploitation could lead to arbitrary code execution in kernel context. Primary risk scenarios include supply-chain attacks via malicious USB devices, evil-maid attacks with crafted HID peripherals, or lateral movement in already-compromised networks. Patches available across multiple stable kernel branches significantly reduce urgency for patched systems. Organizations should prioritize patching on systems regularly exposed to untrusted HID devices (public kiosks, shared workstations, IoT gateways) over isolated servers without physical peripheral access.

An attacker deploys a malicious USB device disguised as a keyboard to a target workstation running vulnerable kernel versions. When connected, the device sends a crafted HID input report with a buffer size smaller than the expected report structure. The undersized buffer triggers the vulnerable memset() in hid_report_raw_event(), causing an out-of-bounds write that corrupts adjacent kernel memory. The attacker leverages this memory corruption to overwrite function pointers or other critical kernel structures, achieving arbitrary code execution with kernel privileges. Publicly available exploit code exists per input data, lowering the technical barrier for exploitation beyond proof-of-concept.