CVE-2026-89619

A flaw was found in the Linux kernel, specifically within the intel-quickspi driver. This vulnerability allows a malicious Human Interface Device (HID) to send an oversized report, which is then copied into a buffer without proper size validation. This leads to a buffer overflow, a type of memory corruption, which could potentially allow an attacker to execute arbitrary code or cause a system crash (denial of service).

A kernel buffer overflow in the Intel QuickSPI HID GET_REPORT path occurs because quickspi_get_report copied the full device supplied report length into the callers hidraw buffer without checking the callers requested length. A local user can potentially trigger this through HIDIOCGFEATURE or HIDIOCGINPUT by requesting a smaller buffer than the report returned by the touch controller, causing an out of bounds write in kernel memory. For the CVSS the PR:L reflects that a local user or process must be able to access the affected hidraw interface, while full administrative privileges are not inherently required in permissive device permission setups. The issue is not network reachable. Impact is at least local denial of service via kernel memory corruption and in the paranoid case may allow confidentiality or integrity impact including privilege escalation if the overflow content and heap layout are controllable enough.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.