CVE-2026-31401

A flaw was found in the Linux kernel's Human Interface Device (HID) BPF (Berkeley Packet Filter) component. This vulnerability occurs in the hid_hw_request function, where an uncontrolled return value from dispatch_hid_bpf_raw_requests() can lead to a buffer overflow. This could allow a local attacker to cause memory corruption, potentially leading to a denial of service or information disclosure.

HID-BPF struct_ops can return an arbitrary length; the driver previously trusted it for sizing. Loading malicious BPF requires privileges (for example CAP_BPF / perfmon depending on configuration). Clamping the return value prevents overflow.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.