CVE-2026-89620

HighCVSS 7.8

Published: 11/09/2026(UTC)Updated: 19/10/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

In the Linux kernel, the intel-quickspi HID driver does not validate the report size before copying it into the report_buf heap buffer. The buffer is sized from the device descriptor (max_report_len), but the report length coming from a hidraw ioctl is unbounded, allowing a buffer overflow with attacker-controlled data.

Risk Assessment

A local attacker with access to the hidraw device can trigger a kernel heap buffer overflow, potentially leading to kernel code execution or a system crash (privilege escalation).

Recommendation

Update the Linux kernel to a version containing the fix that validates the report size before copying in intel-quickspi (matching the intel-quicki2c and hid-goodix-spi guards).

Other vulnerabilities in Linux kernel (intel-quickspi HID driver)

CVE-2026-89619High
In the Linux kernel, quickspi_get_report() in the intel-quickspi HID driver copies the entire device response into the caller's buffer without checking its length. A response larger than the caller's buffer overflows it with device-controlled content.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy write_cmd_to_txdma() builds an output report in qsdev->report_buf, a heap buffer allocated in quickspi_alloc_report_buf() to the device-descriptor derived max_report_len (a few hundred bytes for a touch controller). It copies the caller-supplied report into that buffer: memcpy(write_buf->content, report_buf, report_buf_len); The HID core caps a report at HID_MAX_BUFFER_SIZE (16384) by default, and quickspi_hid_ll_driver does not set max_buffer_size, so the length reaches the driver unbounded. A hidraw SET_REPORT/SET_FEATURE ioctl carrying a report larger than max_report_len therefore overflows report_buf with attacker-controlled length and content. Record the report_buf allocation size and reject reports that do not fit before copying, matching the equivalent guard in the intel-quicki2c sibling (quicki2c_init_write_buf()) and the hid-goodix-spi fix. write_cmd_to_txdma() writes the output report header ahead of the content in the same buffer, so size the allocation to cover the header as well. That keeps the added bound from rejecting a maximum-sized report.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS