CVE-2026-90000

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: rmi: fix OOB access with undersized RMI reports

The hid-rmi driver sizes its writeReport/readReport buffer purely from

the report descriptor supplied by the device, with no minimum bound:

data->input_report_size = hid_report_len(input_report);

data->output_report_size = hid_report_len(output_report);

alloc_size = data->output_report_size + data->input_report_size;

data->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL);

data->readReport = data->writeReport + data->output_report_size;

but then reads and writes fixed offsets into it. A device declaring a

1-byte output and a 1-byte input report makes hid_report_len() return 2

for each, so alloc_size is 4, while rmi_set_page() -- reached

unconditionally at probe time through rmi_input_configured() -- stores

writeReport[4] and rmi_hid_read_block() stores writeReport[0..5]. Since

readReport lives at writeReport + output_report_size, those stores

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References