CVE-2026-80604

A flaw was found in the Linux kernel's Human Interface Device (HID) core. When processing numbered reports, the hid_get_report() function can attempt to read data from an invalid memory location if a size of zero is provided. This out-of-bounds read can lead to a kernel panic, effectively causing a denial of service for the system.

A numbered HID report can reach hid_get_report with size 0 before input length validation, causing an out of bounds read of data(0) while extracting the report ID. A malicious or faulty HID device can trigger this through the HID input path and may cause a kernel crash or warning depending on memory layout and transport behavior. For the CVSS the PR:N because the attacker does not need privileges on the target once the malicious HID input can be delivered. The base vector treats this mainly as a physical device attack with user involvement for device connection or pairing. The paranoid vector treats wireless or already connected HID transports as adjacent and uses C:L because this is an OOB read, while integrity remains N because no write primitive is shown. Impact is mainly denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.