CVE-2026-89619 Overview
CVE-2026-89619 is a buffer overflow vulnerability in the Linux kernel's Intel Touch Host Controller (THC) HID driver, specifically in the intel-quickspi component. The flaw resides in quickspi_get_report(), which copies a device-supplied HID report into the caller's buffer without validating the buffer length. A response larger than the caller's buffer overflows memory with device-controlled content. The vulnerability affects local systems where the intel-quickspi driver handles touch controller communication via HIDIOCGFEATURE or HIDIOCGINPUT ioctls through the hidraw interface.
Critical Impact
A local attacker with access to the hidraw device, or a malicious or compromised touch controller, can trigger a kernel buffer overflow leading to memory corruption, privilege escalation, or system compromise.
Affected Products
- Linux kernel versions containing the intel-thc-hidintel-quickspi driver
- Systems using Intel Touch Host Controller with SPI-connected HID touch devices
- Distributions shipping kernels prior to the fixes referenced in commits 035ec4a7, 54e0bafc, and 72706b44
Discovery Timeline
- 2026-09-11 - CVE-2026-89619 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89619
Vulnerability Analysis
The vulnerability exists in the quickspi_hid_raw_request() path within the Linux kernel's intel-thc-hid driver. The function receives the caller's buffer length in the len parameter, but this value is never propagated to quickspi_get_report(). As a result, the report handler copies the entire device-supplied response into the destination buffer without any bounds check.
The unsafe operation is a single memcpy(buf, qsdev->report_buf, qsdev->report_len) call. Here, qsdev->report_len is controlled by the touch controller's returned input report, while buf is sized according to what the caller passed to hidraw through HIDIOCGFEATURE or HIDIOCGINPUT. When the device report exceeds the caller's buffer, the copy writes past the allocation, corrupting adjacent kernel memory with attacker-influenceable content.
The sibling intel-quicki2c driver already validates the response length against the caller's buffer before copying. The fix mirrors this behavior in intel-quickspi, propagating the length parameter and rejecting oversized responses before the memcpy.
Root Cause
The root cause is missing input validation in a kernel driver's report copy path. The function API dropped the caller-supplied length parameter, leaving the copy dependent on a length field derived from an untrusted or externally influenced source: the device's own input report. The vulnerability aligns with classic out-of-bounds write and improper input validation weaknesses in kernel drivers.
Attack Vector
Exploitation requires local access. An attacker with permission to open the hidraw device node can issue HIDIOCGFEATURE or HIDIOCGINPUT requests with a small buffer. If the touch controller returns a report larger than that buffer, either through firmware manipulation, a malicious peripheral, or a compromised device state, the kernel writes controller-supplied bytes past the buffer boundary. The overflow occurs in kernel memory, enabling potential privilege escalation to root or denial of service through kernel panic.
No verified public exploit code is available for CVE-2026-89619. See the Kernel Git Commit 035ec4a for the upstream patch details.
Detection Methods for CVE-2026-89619
Indicators of Compromise
- Unexpected kernel oops, panic, or BUG: messages referencing quickspi_get_report or intel-thc-hid in dmesg output
- KASAN reports flagging out-of-bounds writes originating in the intel-quickspi module
- Anomalous hidraw ioctl activity from unprivileged user-space processes targeting Intel touch controller devices
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) on test and staging systems to surface out-of-bounds writes in the intel-thc-hid path
- Audit installed kernel versions against the fixed commits 035ec4a71cb8, 54e0bafc0653, and 72706b44b665 referenced in the upstream advisory
- Monitor process execution and ioctl syscalls against /dev/hidraw* device nodes for unusual patterns
Monitoring Recommendations
- Collect and forward kernel logs to a centralized logging pipeline to detect driver crashes tied to touch controller subsystems
- Track loaded kernel modules across the fleet and flag hosts running vulnerable intel_thc or intel_quickspi modules
- Alert on unexpected privilege escalations on systems equipped with Intel THC hardware, correlating with hidraw access events
How to Mitigate CVE-2026-89619
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits 035ec4a71cb8, 54e0bafc0653, and 72706b44b665 as delivered by your distribution
- Restrict access to /dev/hidraw* device nodes to trusted users and processes through udev rules and group permissions
- On systems that do not require the driver, unload or blacklist the intel_quickspi and related intel_thc modules
Patch Information
The Linux kernel maintainers resolved this issue by propagating the caller's buffer length into quickspi_get_report() and validating the device response size before the memcpy call, matching the existing behavior in the intel-quicki2c sibling driver. Refer to the upstream fixes: Kernel Git Commit 035ec4a, Kernel Git Commit 54e0bafc, and Kernel Git Commit 72706b44. Update to a distribution kernel that incorporates these commits.
Workarounds
- Blacklist the intel_quickspi module on systems that do not require SPI-attached touch input
- Tighten permissions on /dev/hidraw* nodes via udev rules so only authorized service accounts can issue HIDIOCGFEATURE or HIDIOCGINPUT ioctls
- Restrict physical port access on hardware that could introduce untrusted HID peripherals capable of returning oversized reports
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
