CVE-2026-89619

The Linux kernel's intel-thc-hid QuickSPI touch driver fails to bound the GET_REPORT response against the caller's buffer size: quickspi_hid_raw_request() receives a length from userspace hidraw ioctls (HIDIOCGFEATURE / HIDIOCGINPUT) but never passes it to quickspi_get_report(), which memcpy's the entire touch-controller-supplied response into the caller's buffer. A malicious or compromised SPI-attached touch controller that returns an oversized report can therefore overflow the buffer with device-controlled content, causing kernel memory corruption with potential crash or privilege-escalation impact (CVSS 3.1: 7.8, local vector, low privileges). Affected systems are those running kernels containing the vulnerable driver on Intel Touch Host Controller hardware with a QuickSPI-attached touch device. The fix mirrors the intel-quicki2c sibling driver by propagating and validating the caller length before the copy. No public proof of concept or in-the-wild exploitation is known, and the issue is not on the CISA KEV list.

What to do: Update to a kernel release that includes the fix, which passes the caller's buffer length into quickspi_get_report() and validates the device response size before copying, matching the intel-quicki2c behavior. If patching is delayed, consider blocking or blacklisting the intel_quickspi driver on affected Intel THC hardware and restricting access to /dev/hidraw nodes. Watch kernel logs for crashes in quickspi_hid_raw_request() during HIDIOCGFEATURE handling as an indicator of oversized device responses.