CVE-2026-80604 Overview
CVE-2026-80604 is an out-of-bounds read vulnerability in the Linux kernel's Human Interface Device (HID) core subsystem. The flaw resides in the hid_report_raw_event() and hid_get_report() functions, which handle numbered HID reports. When a caller passes a report size of 0 for a numbered report, hid_get_report() unconditionally dereferences data[0] to extract the report ID before size validation occurs. This out-of-bounds read can trigger a kernel panic or leak adjacent memory contents. The vulnerability affects Linux kernel builds prior to the upstream fix and requires adjacent network access with no authentication or user interaction.
Critical Impact
An attacker with adjacent access to a vulnerable HID transport can cause a kernel panic or read out-of-bounds kernel memory, compromising system availability and confidentiality.
Affected Products
- Linux kernel (mainline and stable branches) prior to the fix commits
- Distributions shipping unpatched HID core code
- Systems exposing HID transports over adjacent interfaces (for example, Bluetooth HID)
Discovery Timeline
- 2026-08-28 - CVE-2026-80604 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80604
Vulnerability Analysis
The vulnerability exists in the HID core layer of the Linux kernel. The function hid_report_raw_event() accepts a data buffer and a size parameter from lower-level HID transport drivers. Before the fix, the function invoked hid_get_report() prior to validating that size was large enough to access the first byte.
Inside hid_get_report(), when the associated report_enum->numbered flag is set to true, the code dereferences data[0] to extract the report identifier. If a caller supplies a zero-length buffer, this dereference reads memory past the intended bounds of the buffer [CWE-125]. The result is either a kernel panic from touching an invalid address or the disclosure of adjacent kernel memory.
The upstream resolution moves the size validation ahead of the hid_get_report() call, ensuring size is at least 1 before any dereference of data.
Root Cause
The root cause is missing input length validation in hid_report_raw_event(). The code assumed that any incoming report for a numbered report_enum would contain at least one byte, but no explicit boundary check enforced that assumption before dereferencing data[0].
Attack Vector
Exploitation requires the attacker to deliver a crafted HID report with a zero-length payload through a HID transport reachable from an adjacent network position. Bluetooth HID and similar transports that can be reached without local shell access are the practical attack surface. No privileges or user interaction are required, and successful exploitation can affect confidentiality, integrity, and availability of the kernel.
No public proof-of-concept exploit code is available. For technical remediation details, refer to the upstream fix commits including Kernel Commit 30ff978, Kernel Commit af1a9b6, Kernel Commit c1fc0d3, and Kernel Commit f8896b6.
// No verified proof-of-concept code is available for CVE-2026-80604.
// See the upstream kernel commits linked above for the exact patch diff.
Detection Methods for CVE-2026-80604
Indicators of Compromise
- Unexpected kernel panics or oops messages referencing hid_get_report or hid_report_raw_event in dmesg and /var/log/kern.log.
- KASAN (Kernel Address Sanitizer) out-of-bounds read reports naming the HID core module on instrumented kernels.
- Sudden Bluetooth or USB HID stack resets correlated with anomalous adjacent-network activity.
Detection Strategies
- Inventory the kernel version running across Linux endpoints and servers and flag hosts running versions predating the upstream fix commits.
- Monitor kernel ring buffer telemetry for stack traces containing HID core symbols and correlate with recent Bluetooth pairings or HID device connections.
- Enable KASAN in test environments to reproduce and verify the vulnerable code path before rolling patches into production.
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on repeated HID subsystem faults from the same host.
- Track Bluetooth radio events and unexpected HID device enumerations on servers and workstations that do not normally use HID peripherals.
- Correlate kernel crash telemetry with physical proximity data or wireless intrusion detection alerts to surface adjacent-network attack attempts.
How to Mitigate CVE-2026-80604
Immediate Actions Required
- Apply the latest stable kernel update from your Linux distribution that incorporates the upstream HID core fix commits.
- Disable Bluetooth and other non-essential HID transports on systems that do not require them, particularly servers.
- Restrict physical and wireless proximity to critical Linux hosts until patching is complete.
Patch Information
The vulnerability is fixed by moving numbered report size validation before the call to hid_get_report(). The upstream patches are available in the following commits: 30ff978, af1a9b6, c1fc0d3, c39f576, c973d53, dd39574, f7e8117, and f8896b6. Consume the fix through your distribution's package manager rather than compiling manually where possible.
Workarounds
- Unload the hid and transport-specific modules such as hid_generic and bluetooth on systems that do not require HID functionality using modprobe -r.
- Blacklist unused HID transport modules in /etc/modprobe.d/ to prevent automatic loading at boot.
- Enforce Bluetooth device allowlists and disable discoverable mode on Linux hosts that must retain HID support.
# Example: blacklist Bluetooth HID transport on hosts that do not need it
echo "blacklist btusb" | sudo tee /etc/modprobe.d/disable-bt-hid.conf
echo "blacklist bluetooth" | sudo tee -a /etc/modprobe.d/disable-bt-hid.conf
sudo modprobe -r btusb bluetooth
# Verify current kernel version and confirm patch level from your distribution
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
