CVE-2026-90001 HID: bpf: serialize device reference release in struct_ops destroy path

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-90001

A race condition in the Linux kernel HID BPF subsystem allows __hid_bpf_ops_destroy_device() and hid_bpf_unreg() to double-put the struct hid_device reference, freeing the device while hid_destroy_device() is still using it. The root cause is a TOCTOU flaw: the two paths run under different lock ...

EUVD-2026-80608

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-90000 HID: rmi: fix OOB access with undersized RMI reports

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-90000

The Linux kernel hid-rmi driver allocates its report buffers based solely on the device-supplied report descriptor, with no minimum size bound. A device declaring undersized reports (as small as 1 byte each) causes out-of-bounds reads and writes past the allocation into adjacent slab objects at p...

CVE-2026-90000 HID: rmi: fix OOB access with undersized RMI reports

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

SUSE CVE-2026-89621

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89999: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

PT-2026-93642

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the hid bpf ops destroy device and hid bpf unreg functions. This occurs because the coordination between device destruction and BPF link release uses a...

PT-2026-93641

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The hid-rmi driver contains an out-of-bounds OOB access issue because it determines the size of writeReport and readReport buffers based solely on the report descriptor provided by the...

PT-2026-93640

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the HID wacom driver. The function wacom intuos pro2 bt irq receives a wire report length in the len variable but fails to validate it before parsing. A...

CVE-2026-90000: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-90001: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-90041: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list on probe failure sonyinputconfigured adds some controllers to sonydevicelist before HID core registers their input devices. inputregisterdevice can fail after the callback returns successfully...

PT-2026-93682

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the HID sony driver where the sony input configured function adds controllers to the sony device list before the HID core registers the input devices. If the input...

PT-2026-93574

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs during the ACPI probe of the dps310 pressure sensor. When the device is enumerated via its ACPI HID IFX3100, the i2c client get device id function retur...

Linux Distros Unpatched Vulnerability : CVE-2026-90000

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by t...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: core: removed the unnecessary WARNON function in the implement function. The syzkaller triggered a warning 1 when calling implement, attempting to write a value into a field of smaller size in an output report. Since impleme...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: HID: amdsfh: Free driverdata after destroying the hid device Driver callbacks for HID are no longer called after the hiddestroydevice function is called. Therefore, the driverdata should only be freed after the hiddestroydevic...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: leds: class: Protect access to brightnessshow using ledcdev-ledaccess mutex There is a NULL pointer issue observed when Process A adds a hid device, resulting in the addition of a ledcdev object. Subsequently, another call to...