CVE-2026-80781: Linux Kernel HID Buffer Overflow Vulnerability

CVE-2026-80781 Overview

CVE-2026-80781 is an out-of-bounds read vulnerability in the Linux kernel's Human Interface Device (HID) core subsystem. The flaw resides in the hid_set_field() function, which passes field->usage + offset to hid_dump_input() before validating the offset against field->report_count. When CONFIG_DEBUG_FS is enabled, hid_dump_input() dereferences the unchecked pointer, reading past the end of a kvzalloc() allocation and into adjacent kernel memory. The picolcd_fb_send_tile() function in the PicoLCD framebuffer driver reliably triggers the condition by issuing offsets of 11 through 42 without checking them against the target field's bound. Kernel Address Sanitizer (KASAN) reports a 4-byte slab-out-of-bounds read from hid_dump_input().

Critical Impact
Local attackers with access to a vulnerable HID device path (or attached PicoLCD hardware) can trigger a kernel slab out-of-bounds read, potentially leaking adjacent kernel memory contents on systems with debug filesystem support enabled.

Affected Products

Linux kernel branches containing the HID core hid_set_field() code path prior to the fix commits
Systems built with CONFIG_DEBUG_FS enabled
Systems using the PicoLCD framebuffer driver (picolcd_fb_send_tile())

Discovery Timeline

Vulnerability discovered by XBOW, triaged by Baul Lee (baul.lee@xbow.com)
2026-09-04 - CVE-2026-80781 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80781

Vulnerability Analysis

The vulnerability is an Out-of-Bounds Read [CWE-125] in the Linux kernel HID core. In hid_set_field(), the debug helper hid_dump_input() is invoked with the expression field->usage + offset before the guard that validates offset >= field->report_count. When CONFIG_DEBUG_FS is compiled in, hid_dump_input() dereferences the resulting pointer through hid_resolv_usage(usage->hid, NULL). The usage[] array is allocated inline with the hid_field structure in hid_register_field() and holds exactly field->maxusage entries. Any offset beyond that bound reads past the kvzalloc() allocation into a neighboring slab object.

Root Cause

The root cause is ordering: the bounds check runs after the pointer is already consumed by the debug logger. Because field->maxusage >= field->report_count, moving the hid_dump_input() call below the guard confines the pointer arithmetic to valid memory for every caller. The prior ordering assumed callers would validate offsets themselves, but this contract was not enforced.

Attack Vector

A caller supplies the out-of-bounds offset today. picolcd_fb_send_tile() validates only report->maxfield before calling hid_set_field(report->field[0], 11 + i, ...) for i = 0..31. The offsets 11..42 are never checked against the target field's report_count. When a PicoLCD device registers that field with fewer usages, the framebuffer deferred-I/O work triggers the out-of-bounds read on every tile update. KASAN reports a 4-byte slab out-of-bounds read and the kernel emits offset (1) exceeds report_count (1) from the guard that fires only after the unsafe dereference.

No synthetic exploitation code is provided. See the upstream fix commits referenced below for the exact source-level change.

Detection Methods for CVE-2026-80781

Indicators of Compromise

KASAN reports containing BUG: KASAN: slab-out-of-bounds in hid_dump_input in dmesg or the kernel ring buffer.
Kernel error messages of the form offset (N) exceeds report_count (M) originating from hid_set_field().
Repeated stack traces referencing picolcd_fb_send_tile and hid_set_field on hosts with attached PicoLCD hardware.

Detection Strategies

Enable KASAN in test and staging kernels to surface the out-of-bounds read during HID device exercise.
Inventory kernel builds for CONFIG_DEBUG_FS=y combined with unpatched HID core sources.
Correlate hid_err log entries with USB device attach events to identify triggering hardware.

Monitoring Recommendations

Forward kernel logs (/dev/kmsg, journald) into a centralized log platform and alert on KASAN and hid_set_field strings.
Track kernel package versions across the fleet and flag hosts running builds predating the fix commits.
Monitor USB device attach events, particularly for PicoLCD or other custom HID peripherals in production environments.

How to Mitigate CVE-2026-80781

Immediate Actions Required

Apply the upstream Linux kernel patches that reorder the hid_dump_input() call to run after the offset >= field->report_count guard.
Rebuild and redeploy affected kernel packages, prioritizing hosts that expose HID device paths to untrusted users.
On production systems where debugging is not required, rebuild kernels with CONFIG_DEBUG_FS disabled to remove the dereference path.

Patch Information

The fix moves the hid_dump_input() call below the bounds guard in hid_set_field(). Upstream commits are available in the stable tree: Kernel Git Commit 313ead1, Kernel Git Commit 465544b, Kernel Git Commit 4993e1a, Kernel Git Commit 5215ea0, Kernel Git Commit 9a1d7c5, Kernel Git Commit a13cdb1, Kernel Git Commit a382126, Kernel Git Commit c1d9c16, and Kernel Git Commit cbcc0e8. Consult your distribution vendor for backported package versions.

Workarounds

Unload or blacklist the hid-picolcd module on systems where PicoLCD hardware is not required.
Restrict physical access to USB ports to prevent attackers from attaching crafted HID devices.
Rebuild the kernel without CONFIG_DEBUG_FS where operational requirements permit, removing the vulnerable dereference path.

bash

# Blacklist the picolcd HID module until patched kernels are deployed
echo 'blacklist hid_picolcd' | sudo tee /etc/modprobe.d/blacklist-picolcd.conf
sudo modprobe -r hid_picolcd 2>/dev/null || true
sudo update-initramfs -u