CVE-2026-80781

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: fix OOB read of field->usage in hid_set_field()

hid_set_field() hands field->usage + offset to hid_dump_input() before

the guard that bounds offset:

hid_dump_input(field->report->device, field->usage + offset, value);

if (offset >= field->report_count) {

hid_err(...);

return -1;

}

Under CONFIG_DEBUG_FS hid_dump_input() dereferences that pointer, with

buf = hid_resolv_usage(usage->hid, NULL). The usage[] array is

allocated inline with the hid_field in hid_register_field() and holds

field->maxusage entries, so an offset past it reads off the end of the

kvzalloc()ed allocation and into a neighbouring object. Had the guard

run first, offset < report_count <= maxusage would already have confined

the pointer to the array.

A caller supplies such an offset today. picolcd_fb_send_tile()

validates only report->maxfield before issuing

hid_set_field(report->field[0], 11 + i, ...) for i = 0..31, so its

of

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References