CVE-2026-90000

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-90000

The Linux kernel hid-rmi driver allocates its report buffers based solely on the device-supplied report descriptor, with no minimum size bound. A device declaring undersized reports (as small as 1 byte each) causes out-of-bounds reads and writes past the allocation into adjacent slab objects at p...

CVE-2026-90000 HID: rmi: fix OOB access with undersized RMI reports

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

EUVD-2026-80608

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...