Loading vulnerability…
Out-of-bounds read in Linux kernel HID numbered-report processing
CVE-2026-80604 is an out-of-bounds read vulnerability in the Linux kernel HID core when processing zero-length numbered reports. The hid_report_raw_event() function calls hid_get_report() before validating the input size. When report_enum->numbered is true, hid_get_report() unconditionally accesses data[0] to obtain the report ID, even when the supplied size is zero. This invalid read can cause a kernel panic and denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Processing a zero-length numbered HID report can trigger an out-of-bounds kernel read and potentially panic the kernel, disrupting the entire affected system. Information disclosure, privilege escalation, and code execution are not established for this vulnerability.
If you can’t patch tonight, do this now.
Until a patched kernel is deployed, prevent untrusted or malformed zero-length numbered reports from reaching HID processing where feasible. Restrict physical and logical access to relevant HID devices and interfaces. Monitor HID-related kernel panics as investigation signals; monitoring does not prevent exploitation.
Patch, then assume compromise.
Apply a vendor-supported Linux kernel update containing the HID core fix. The fix moves numbered-report size validation ahead of the call to hid_get_report(), ensuring that the input contains at least one byte before the report ID is accessed. For affected Ubuntu NVIDIA kernel packages, the listed fixed versions are 7.0.0-2022.23 on Ubuntu 26.04 LTS and 7.0.0-1024.25~24.04.1 on Ubuntu 24.04 LTS; reboot after updating and rebuild third-party kernel modules if required by the ABI change. For affected Android devices, install the applicable manufacturer-provided November 2026 security update, targeting security patch level 2026-11-05 where available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.