CVE-2026-72352

A flaw was found in the Linux kernel's Human Interface Device (HID) Berkeley Packet Filter (BPF) component. An integer overflow, where a calculation exceeds the maximum value an integer type can store, in the hid_bpf_get_data() function's range check can occur when processing a very large size value. This allows the function to return a pointer to memory outside its intended buffer, potentially leading to out-of-bounds memory access. A local attacker could use this flaw to cause a denial of service or potentially escalate privileges.

Red Hat rates the impact of this flaw as Moderate. An integer overflow flaw was found in the Linux kernel's Human Interface Device (HID) Berkeley Packet Filter (BPF) subsystem. The hid_bpf_get_data() helper validates a caller-provided offset and size by adding the two unsigned values and comparing the sum against the allocated context buffer size; a very large size value can wrap this sum so that it appears smaller than the buffer, causing the helper to return a pointer to memory outside the intended backing buffer. A local attacker able to load and run a malicious HID-BPF program could use this out-of-bounds access to crash the kernel (denial of service) or potentially escalate privileges. Red Hat Enterprise Linux 9 (kernel and kernel-rt in the affected update streams), Red Hat Enterprise Linux 10 (kernel), and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) are affected; the fix for these streams is currently deferred, so the residual risk remains that a local attacker with the ability to load or run an affected HID-BPF program could trigger an out-of-bounds kernel memory access. Earlier Red Hat Enterprise Linux versions and streams (RHEL 6, RHEL 7, RHEL 8, and RHEL 9.2) are not affected because the vulnerable code, introduced with the change that allocates data memory for device_event BPF programs, is not present in those kernels. Upstream rates this flaw as Important (CVSS 3.1 score 7.8, C:H/I:H/A:H) while Red Hat rates it Moderate (CVSS 3.1 score 5.5, C:N/I:N/A:H), because the Red Hat score reflects availability-only impact for this local attack path that requires privileges to load or run a HID-BPF program.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.