CVE-2026-80918: Linux Kernel HID Information Disclosure Flaw

CVE-2026-80918 Overview

CVE-2026-80918 is a type confusion vulnerability in the Linux kernel's Human Interface Device (HID) core subsystem. The flaw resides in fetch_item(), item_udata(), and item_sdata() when processing HID report descriptors that contain items encoded with the HID_ITEM_TAG_LONG tag. The kernel incorrectly interprets a stored pointer as a numeric value, leaking the lower half of a kernel pointer into dmesg and creating a number/pointer type confusion condition.

Critical Impact
A malicious or malformed USB HID device can trigger kernel pointer disclosure through dmesg, undermining Kernel Address Space Layout Randomization (KASLR) and enabling downstream local privilege escalation research.

Affected Products

Linux kernel HID core subsystem (drivers/hid/hid-core.c)
Stable Linux kernel branches referenced by the fix commits
Systems processing HID report descriptors from attached USB or Bluetooth peripherals

Discovery Timeline

2026-09-09 - CVE-2026-80918 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80918

Vulnerability Analysis

The Linux HID core parses report descriptors item-by-item using fetch_item(). When the function encounters an item tagged HID_ITEM_TAG_LONG, it stores a pointer to the item's data buffer in item->data.longdata rather than placing an inline scalar in item->data.{u8,u16,u32}. Both item_udata() and item_sdata() unconditionally assume the short-form layout and dereference the union as an integer. The result is that the lower bits of a kernel pointer are returned as if they were the item's numeric payload.

The consequence surfaces during hid_scan_report(), where a descriptor carrying a HID_GLOBAL_ITEM_TAG_REPORT_SIZE in long format with size=4 produces a log line such as hid (null): invalid report_size 107953555. The printed value is a leaked kernel address fragment. The main parsing pass, hid_parse_collections(), is unaffected because it bails out when it encounters any long item.

Root Cause

The root cause is missing format validation inside the accessors. item_udata() and item_sdata() read from a union without checking item->format, treating a longdata pointer as if it were a short-form scalar. This is a classic type confusion pattern in a shared union representation.

Attack Vector

Exploitation requires a HID device (USB or Bluetooth) whose report descriptor includes a long-format item with a global report size tag. On enumeration, hid_scan_report() walks the descriptor, invokes the vulnerable accessors, and prints the pointer-derived value through the kernel log facility. An attacker with physical access, a malicious peripheral, or a compromised BadUSB-class device can trigger the disclosure. Any local user able to read dmesg can then harvest the leaked pointer to defeat KASLR.

No verified proof-of-concept code is published. See the upstream kernel commits
referenced below for the exact patched call sites in drivers/hid/hid-core.c.

Detection Methods for CVE-2026-80918

Indicators of Compromise

Kernel log entries matching the pattern hid (null): invalid report_size <large_number> where the number does not correspond to any legitimate report size
Newly attached HID devices whose descriptors advertise long-format items during enumeration
Unexpected HID enumeration events on servers, kiosks, or workstations that do not normally receive new peripherals

Detection Strategies

Parse /var/log/kern.log and journalctl -k output for invalid report_size messages emitted by the HID core
Correlate USB device connection telemetry (udev events, usbmon) with anomalous HID descriptor sizes or long-format tags
Track processes reading dmesg after HID enumeration to identify potential pointer-leak harvesting

Monitoring Recommendations

Restrict dmesg visibility by setting kernel.dmesg_restrict=1 and monitor changes to this sysctl
Alert on USB peripheral connection events on production servers where physical access should be constrained
Ingest kernel logs into a centralized analytics pipeline to identify HID parsing anomalies across the fleet

How to Mitigate CVE-2026-80918

Immediate Actions Required

Apply the upstream kernel patches referenced below and rebuild or update to a fixed stable kernel release
Set kernel.dmesg_restrict=1 to prevent unprivileged users from reading kernel pointer leaks
Enforce USB device allowlisting via USBGuard or equivalent controls on sensitive systems

Patch Information

The fix modifies item_udata() and item_sdata() to verify that the item is in short format before returning its data. The patch has been backported across multiple stable branches. See the upstream commits: Kernel Commit 1fa1591, Kernel Commit 28abce9, Kernel Commit 634f498, Kernel Commit abec577, Kernel Commit aec2c2e, Kernel Commit bed7fe3, Kernel Commit dd8035d, Kernel Commit e542eda, and Kernel Commit e60159f.

Workarounds

Restrict physical access to USB ports on servers and unattended endpoints
Disable the usbhid and hid-generic modules on systems that do not require HID peripherals
Deploy USB port controls or endpoint policy to block enumeration of untrusted HID devices

bash

# Restrict dmesg to root and block untrusted HID modules where not needed
sudo sysctl -w kernel.dmesg_restrict=1
echo 'kernel.dmesg_restrict=1' | sudo tee /etc/sysctl.d/99-dmesg-restrict.conf

# Optional: prevent automatic loading of usbhid on locked-down systems
echo 'blacklist usbhid' | sudo tee /etc/modprobe.d/blacklist-usbhid.conf
sudo update-initramfs -u