CVE-2026-90000

A flaw was found in the Linux kernel's hid-rmi driver. A malicious or specially crafted Human Interface Device (HID) can provide undersized Remote Memory Interface (RMI) reports, leading to out-of-bounds memory access. This vulnerability allows for information disclosure, where sensitive heap contents can be leaked to unprivileged users and the device. Additionally, a crafted zero-length reply can cause an infinite loop, resulting in a denial of service.

An out-of-bounds access in the HID/RMI driver occurs because report buffer sizes are taken from the device supplied HID report descriptor while the driver later uses fixed offsets and device controlled lengths. A malicious RMI HID device can declare undersized input or output reports and trigger OOB reads, OOB writes, heap data exposure through product id handling and sysfs, or a stuck probe worker via zero length replies. For the CVSS the PR:L is used for the higher paranoid local software trigger path because a local user or service with access to /dev/uhid or a USB gadget interface may emulate the device without full host administration. The issue is not network reachable and normally requires physical device attachment or local device emulation access. Impact is at least denial of service and information disclosure, and in worst case may allow privilege escalation because the patch context shows both OOB read and OOB write primitives in kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.