CVE-2026-98860
kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 18, 2026
Updated · October 24, 2026
Description
A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem. This flaw can lead to information disclosure when hardware communication errors occur. Due to an improper integer comparison in the Berkeley Packet Filter (BPF) handler, negative error return codes are mistakenly treated as a valid buffer size, causing failed device requests to be reported as successful. A local user running BPF programs can leverage this issue to process unmodified buffers containing uninitialized or stale data.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 1.9CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CWE-908 · Use of Uninitialized Resource