CVE-2026-89620

The Linux kernel's intel-thc-hid intel-quickspi driver builds output HID reports in a heap buffer (qsdev->report_buf) sized to the device-descriptor-derived max_report_len of only a few hundred bytes, but write_cmd_to_txdma() copies caller-supplied report data without validating that it fits. Because the quickspi low-level HID driver does not set a max_buffer_size, the HID core's default cap of 16384 bytes reaches the driver unbounded, so a local attacker with access to the hidraw device can trigger the overflow via a SET_REPORT/SET_FEATURE ioctl carrying an oversized, fully attacker-controlled report. Successful exploitation corrupts adjacent heap memory and, given the CVSS 7.8 impact ratings (confidentiality, integrity and availability all high), plausibly enables kernel memory corruption and local privilege escalation to root. Affected systems are those running kernels that include the intel-quickspi driver together with an Intel THC touch controller attached over SPI (typical of recent touch-enabled Intel client platforms). No public proof of concept is known and the issue is not on the CISA KEV list.

What to do: Apply a kernel update containing the upstream fix that records the report_buf allocation size (including the output report header) and rejects oversized reports before copying. Verify whether you are exposed by checking if the intel-quickspi/THC driver is loaded or bound (e.g., lsmod and the hidraw device nodes for the touch controller) on touch-enabled Intel hardware. As defense-in-depth, restrict access to /dev/hidraw* nodes (udev rules or group membership) so untrusted local users cannot issue SET_REPORT/SET_FEATURE ioctls to the touch controller.