CVE-2026-80604

CVE-2026-80604 is an out-of-bounds read in the Linux kernel's HID core: when hid_report_raw_event() is invoked with a buffer size of 0 for a numbered report, hid_get_report() unconditionally dereferences data[0] to extract the report ID before any size validation, causing an out-of-bounds read or kernel panic. A malicious or compromised HID device (for example over USB or Bluetooth) that delivers a zero-length numbered report can trigger the flaw. An attacker gains denial of service via kernel panic and potentially disclosure of adjacent kernel memory; the assigned CVSS 3.1 score is 8.8 (high, adjacent attack vector). Any Linux system running a kernel with the vulnerable HID core path is affected, though the source data does not specify affected or fixed version ranges. No exploitation is currently known: there is no public proof of concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Obtain the fix via your distribution's kernel security channel or by moving to a kernel that includes the HID core commit "HID: core: Fix OOB read in hid_get_report for numbered reports"; the source data does not state a minimum fixed version, so do not assume any specific release. Until patched, avoid attaching untrusted or low-quality USB/Bluetooth HID devices to sensitive hosts and check whether HID support (especially Bluetooth HID) is enabled. Given no public PoC, no KEV listing and a 0.3% EPSS score, scheduling this within normal patch cadence is reasonable for most environments.