CVE-2026-64367: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64367 Overview

CVE-2026-64367 is a stack buffer overflow vulnerability in the Linux kernel's hid-goodix-spi driver. The flaw resides in the goodix_hid_set_raw_report() function, which constructs a protocol frame in a 128-byte stack buffer (tmp_buf) without validating the size of caller-supplied report data. A local user can trigger the overflow through a hidrawSET_REPORT ioctl by submitting a report larger than approximately 116 bytes. The HID core caps report size at HID_MAX_BUFFER_SIZE (16384 bytes) by default, and the driver does not set hid_ll_driver.max_buffer_size, leaving the memcpy unchecked. The vulnerability was discovered by Atuin, an automated vulnerability discovery engine.

Critical Impact
Local attackers with access to hidraw interfaces can overflow the kernel stack, potentially leading to arbitrary code execution in kernel context or complete system compromise.

Affected Products

Linux kernel versions containing the hid-goodix-spi driver prior to the fix
Systems using Goodix HID over SPI touchscreen or input devices
Distributions shipping vulnerable stable kernel branches referenced in the upstream commits

Discovery Timeline

2026-07-25 - CVE-2026-64367 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64367

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow [CWE-121] in the Linux kernel HID subsystem. The goodix_hid_set_raw_report() function allocates a fixed 128-byte stack buffer named tmp_buf to assemble an outbound SPI protocol frame. The function writes an 11 to 12 byte header into this buffer, then appends caller-supplied report data using memcpy(tmp_buf + tx_len, buf, len) without verifying that tx_len + len fits within the 128-byte allocation.

Because the HID core defaults HID_MAX_BUFFER_SIZE to 16384 bytes and the driver never overrides this by setting hid_ll_driver.max_buffer_size, reports of up to 16 KB pass through the HID layer unmodified. Any payload larger than roughly 116 bytes writes past the end of the stack buffer, corrupting return addresses, saved registers, and adjacent stack frames.

Root Cause

The root cause is missing input validation between the HID core and driver-specific transport code. The hid-goodix-spi driver trusts the size supplied by the HID subsystem without enforcing its own transport-level maximum. The upstream patch adds an explicit size check after header construction, rejecting reports that would exceed the buffer capacity.

Attack Vector

Exploitation requires local access and permission to open a hidraw character device associated with a Goodix SPI HID device. An attacker issues a HIDIOCSFEATURE or HIDIOCSINPUT ioctl (SET_REPORT) with a crafted payload exceeding 116 bytes. The oversized memcpy overwrites the kernel stack, enabling potential control-flow hijack or privilege escalation from an unprivileged context that holds hidraw access.

Technical details of the fix are available in the upstream commits: 835fcc8, ad47ad6, dae1d00, and db0a076.

Detection Methods for CVE-2026-64367

Indicators of Compromise

Unexpected kernel oops or panic messages referencing goodix_hid_set_raw_report or hid-goodix-spi in dmesg and /var/log/kern.log
Stack protector (__stack_chk_fail) traps originating from the HID SPI transport path
Unprivileged processes opening /dev/hidraw* nodes bound to Goodix SPI devices and issuing large SET_REPORT ioctls

Detection Strategies

Audit kernel ring buffer output for KASAN or stack corruption reports naming the hid-goodix-spi module
Instrument ioctl syscalls targeting hidraw devices and flag HIDIOCSFEATURE or HIDIOCSINPUT calls with payload sizes exceeding 116 bytes
Correlate loaded kernel module version with the fixed commit hashes to identify unpatched hosts

Monitoring Recommendations

Collect kernel logs centrally and alert on stack protector failures, oops traces, and module taint events
Monitor process access to /dev/hidraw* nodes and baseline expected consumers such as input daemons
Track kernel package versions across the fleet and flag hosts running vulnerable stable branches

How to Mitigate CVE-2026-64367

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and reboot affected systems
Restrict permissions on /dev/hidraw* device nodes so only trusted users and services can issue SET_REPORT ioctls
Unload the hid-goodix-spi module on systems that do not require Goodix SPI HID support

Patch Information

The fix adds a size check after header construction in goodix_hid_set_raw_report(), rejecting reports that would exceed the 128-byte tmp_buf capacity. Patched commits are available in the stable kernel tree: 835fcc8655569737e3f057d42875a96259db74c2, ad47ad624f2fce0bc44bbadb664242461a97d774, dae1d000ddfd5c2140b036e47fff0c497ae9c64b, and db0a0768d09273aadadeb76730cd658d720333a4. Consult your distribution's security advisories for backported package releases.

Workarounds

Blacklist the hid-goodix-spi module on systems without Goodix SPI hardware using /etc/modprobe.d/ blacklist entries
Tighten udev rules to set restrictive ownership and mode bits (for example 0600 root-only) on /dev/hidraw* nodes
Enforce mandatory access control policies (SELinux, AppArmor) that deny unprivileged processes access to hidraw interfaces

bash

# Example udev rule to restrict hidraw access to root only
# /etc/udev/rules.d/99-hidraw-restrict.rules
KERNEL=="hidraw*", MODE="0600", OWNER="root", GROUP="root"

# Blacklist the vulnerable driver if unused
# /etc/modprobe.d/blacklist-goodix-spi.conf
blacklist hid-goodix-spi