CVE-2026-89729

The Linux kernel's HID sensor-hub driver contains an out-of-bounds write in sensor_hub_get_feature(): although the return value is clamped to the caller's buffer size, the copy loop writes field->report_size / 8 bytes for each report value regardless of the actual buffer. A malicious HID descriptor advertising an oversized feature field can therefore overflow the small stack buffers that IIO HID sensor callers typically supply (for example, a single 32-bit integer), corrupting kernel stack memory. Exploitation requires an attacker to supply a malicious HID descriptor, meaning a crafted or compromised physical HID device (such as a malicious USB sensor device) attached to the target system, after which the flaw yields kernel memory corruption with potential for privilege escalation (CVSS 8.8, high impact to confidentiality, integrity, and availability). All systems running kernel versions before the upstream fix, with the HID sensor-hub driver present and HID sensor consumers in use, are potentially affected; the issue is resolved by rejecting feature fields needing more than one 32-bit slot per value and clamping each copy to the remaining buffer. No public proof of concept is known and there is no evidence of in-the-wild exploitation.

What to do: Apply distribution kernel updates or stable backports containing the sensor-hub fix as soon as they are available. Because exploitation requires a malicious attached HID device, enforce physical access controls and USB device-allowlisting policies (e.g., via USBGuard) on sensitive Linux endpoints. On systems that do not use HID-based sensors, consider blacklisting the hid-sensor-hub module as a hardening measure, noting that this may disable ambient light sensors, accelerometers, or rotation detection on some laptops.