CVE-2026-89619

HighCVSS 7.8

Published: 11/09/2026(UTC)Updated: 19/10/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

In the Linux kernel, quickspi_get_report() in the intel-quickspi HID driver copies the entire device response into the caller's buffer without checking its length. A response larger than the caller's buffer overflows it with device-controlled content.

Risk Assessment

A local attacker can exploit the kernel buffer overflow via HIDIOCGFEATURE or HIDIOCGINPUT requests, potentially leading to kernel code execution or a system crash.

Recommendation

Update the Linux kernel to a version containing the fix that passes the caller's buffer length to quickspi_get_report() and validates the response before copying.

Other vulnerabilities in Linux kernel (intel-quickspi HID driver)

CVE-2026-89620High
In the Linux kernel, the intel-quickspi HID driver does not validate the report size before copying it into the report_buf heap buffer. The buffer is sized from the device descriptor (max_report_len), but the report length coming from a hidraw ioctl is unbounded, allowing a buffer overflow with attacker-controlled data.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer quickspi_hid_raw_request() receives the caller's buffer length in len, but quickspi_get_report() never sees it and copies the whole device-supplied response into buf regardless: memcpy(buf, qsdev->report_buf, qsdev->report_len); qsdev->report_len comes from the input report the touch controller returns, while buf is sized to whatever the caller asked hidraw for through HIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf with device-controlled content. The intel-quicki2c sibling already passes the caller length down to quicki2c_get_report() and validates the response against it before the copy. Do the same here.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS