CVE-2026-80604: Linux

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic. Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.

Affected products

• Linux Linux: from 5.10.259, before 5.10.261 (fixed in 5.10.261); from 5.15.210, before 5.15.212 (fixed in 5.15.212); from 6.1.176, before 6.1.178 (fixed in 6.1.178); from 6.6.143, before 6.6.145 (fixed in 6.6.145); from 6.12.93, before 6.12.97 (fixed in 6.12.97); from 6.18.33, before 6.18.40 (fixed in 6.18.40); …

Published 2026-08-28. Last modified 2026-08-29.