CVE-2026-89620

A flaw was found in the Linux kernel's HID Intel QuickSPI driver. A local attacker can exploit a heap buffer overflow by providing a specially crafted report through a hidraw SETREPORT/SETFEATURE ioctl. This allows the attacker to overflow a buffer with controlled length and content, potentially...

DEBIAN-CVE-2026-89619

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

CVE-2026-89619

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

CVE-2026-89620

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

DEBIAN-CVE-2026-89620

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89619

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

UBUNTU-CVE-2026-89620

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89620

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

UBUNTU-CVE-2026-89619

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

EUVD-2026-76531

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

CVE-2026-89619 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

CVE-2026-89619 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

CVE-2026-89620

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89619

A buffer overflow in the Linux kernel's intel-quickspi HID driver (part of the intel-thc-hid subsystem) occurs because quickspi_get_report() copies the entire device-supplied report into the caller's buffer without validating it against the caller-provided length. A malicious HID touch controller...

CVE-2026-89620 HID: intel-thc-hid: intel-quickspi: validate report size before copy

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

EUVD-2026-76532

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89620

CVE-2026-89620 affects the Linux kernel HID Intel QuickSPI driver (intel-thc-hid: intel-quickspi). The function write_cmd_to_txdma() copies a caller-supplied report into a heap buffer (report_buf) sized to the device-descriptor-derived max_report_len (a few hundred bytes) without validating that ...

CVE-2026-89620 HID: intel-thc-hid: intel-quickspi: validate report size before copy

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89619

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

EUVD-2026-76354

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...