CVE-2026-80780: Linux Kernel HID Buffer Overflow Vulnerability

CVE-2026-80780 Overview

CVE-2026-80780 is an out-of-bounds write vulnerability in the Linux kernel's Human Interface Device (HID) Physical Interface Device force feedback (pidff) driver. The function hid_pidff_init_with_quirks() derives an input_dev pointer from hid->inputs without validating that the list is non-empty. When empty, list_entry() yields the list head itself, producing a type-confused pointer. Subsequent set_bit(FF_*, dev->ffbit) operations write 8 bytes past the aliased object, and input_ff_create() writes additional pointers. The flaw is reachable through universal_pidff_probe() on the USB hotplug path, allowing a malicious USB device to trigger the write on connect.

Critical Impact
Physical attackers can trigger kernel memory corruption simply by plugging in a malicious USB HID device with a PID usage page descriptor. No user login or attacker software is required.

Affected Products

Linux kernel builds including the hid-universal-pidff driver
Kernel branches referenced in the stable tree commits 2e0471bf, 4529c03c, 67bb1074, 86b63adf, ad9330f7, and d416eeb7
Systems exposing USB ports to untrusted devices running affected kernels

Discovery Timeline

Vulnerability discovered by XBOW and triaged by Baul Lee
2026-09-04 - CVE-2026-80780 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80780

Vulnerability Analysis

The defect lives in hid_pidff_init_with_quirks() inside the Linux kernel HID force-feedback subsystem. The function retrieves the first hid_input from the hid->inputs linked list using list_entry(hid->inputs.next, struct hid_input, list) without checking whether the list is empty. Because the list member of struct hid_input sits at offset 0, an empty list makes list_entry() return &hid->inputs itself. The subsequent hidinput->input load then reads an unrelated field of struct hid_device and treats it as an input_dev pointer.

Force-feedback initialization then writes through this type-confused pointer. Each set_bit(FF_*, dev->ffbit) stores 8 bytes at dev + 192, and input_ff_create() adds further writes containing a heap pointer and two function pointers. KASAN flags an 8-byte out-of-bounds write in hid_pidff_init_with_quirks() reached from universal_pidff_probe(). This is an [CWE-787] out-of-bounds write combined with type confusion.

Root Cause

The original caller, hid_pidff_init() from usbhid, always ran under HID_CLAIMED_INPUT and therefore always had at least one hid_input. The newer universal_pidff_probe() starts the device with HID_CONNECT_DEFAULT & ~HID_CONNECT_FF and then calls hid_pidff_init_with_quirks() directly whenever the descriptor carries a PID usage page. This path bypasses the input claim gate. A report descriptor whose only application collection is on HID_UP_PID leaves hid->inputs empty while hid_connect() still succeeds through the hidraw claim.

Attack Vector

An attacker crafts a USB HID device whose report descriptor contains only a PID application collection. When the device is plugged in, the hotplug workqueue invokes universal_pidff_probe(), which reaches the unguarded list_entry() call and triggers the out-of-bounds write in kernel memory. No logged-in user, no attacker-supplied userland software, and no privileges on the host are required. Exploitation requires physical or supply-chain access to a USB port on the target system.

See the upstream fix in the Kernel Git Commit d416eeb7 and companion backports for the exact patch details.

Detection Methods for CVE-2026-80780

Indicators of Compromise

KASAN reports referencing an 8-byte out-of-bounds write in hid_pidff_init_with_quirks() originating from universal_pidff_probe()
Kernel oops or panic traces on the hotplug workqueue immediately following USB device insertion
Unexpected hid-universal-pidff probe failures or crashes tied to devices exposing HID_UP_PID usage pages

Detection Strategies

Enable KASAN on test kernels to surface the out-of-bounds write during hardware qualification of new USB peripherals
Monitor dmesg and journald for kernel warnings mentioning pidff, universal_pidff_probe, or input_ff_create on production endpoints
Correlate USB device insertion events (udev) with subsequent kernel error traces to identify suspicious devices

Monitoring Recommendations

Ingest kernel logs into a centralized logging pipeline and alert on KASAN, BUG:, and WARNING: entries referencing HID subsystem functions
Track USB device connection telemetry including vendor and product IDs to flag unauthorized or unknown HID devices
Review endpoint crash telemetry for repeated failures on the hotplug workqueue that could indicate exploitation attempts

How to Mitigate CVE-2026-80780

Immediate Actions Required

Apply the upstream Linux kernel patch that adds an empty-list check in hid_pidff_init_with_quirks() and returns -ENODEV before dereferencing
Update to a distribution kernel release that includes the fix from stable commits d416eeb7, 86b63adf, ad9330f7, 4529c03c, 2e0471bf, or 67bb1074
Restrict physical access to USB ports on servers, kiosks, and other unattended systems

Patch Information

The fix checks whether hid->inputs is empty before deriving dev and returns -ENODEV when it is, aligning pidff with other HID force-feedback drivers. universal_pidff_probe() propagates the error and unwinds cleanly. Backports are available in the stable tree via Kernel Git Commit 2e0471bf, Kernel Git Commit 4529c03c, Kernel Git Commit 67bb1074, Kernel Git Commit 86b63adf, Kernel Git Commit ad9330f7, and Kernel Git Commit d416eeb7.

Workarounds

Blacklist the hid-universal-pidff module on systems that do not require universal PID force-feedback support
Enforce USB device allowlisting via USBGuard or equivalent tooling to block unknown HID devices at connect time
Disable USB ports in firmware or hardware on systems where peripherals are not needed

bash

# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist hid-universal-pidff" | sudo tee /etc/modprobe.d/blacklist-pidff.conf
sudo update-initramfs -u