CVE-2026-89729

A flaw was found in the Linux kernel's Human Interface Device (HID) sensor-hub driver. A local attacker could exploit this vulnerability by providing a specially crafted HID descriptor. This malicious descriptor could cause the sensor_hub_get_feature() function to write data beyond the intended memory buffer. This out-of-bounds write could lead to a system crash (denial of service) or potentially allow for arbitrary code execution, compromising the system's integrity.

This vulnerability is rated as Moderate severity because exploitation requires local access and either physical connection of a specialized device or privileged access to emulate HID hardware. In typical Red Hat Enterprise Linux server environments, sensor hub hardware is rarely present, significantly constraining practical exposure. An attacker who successfully triggers this issue could corrupt kernel memory to cause a denial of service or potentially elevate privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.