CVE-2026-89620: Linux Kernel Intel-THC-HID Buffer Overflow

CVE-2026-89620 Overview

CVE-2026-89620 is a heap buffer overflow in the Linux kernel's intel-thc-hid driver, specifically in the intel-quickspi component. The flaw resides in write_cmd_to_txdma(), which copies a caller-supplied HID report into qsdev->report_buf without validating the report length against the allocated buffer size. Because quickspi_hid_ll_driver does not set max_buffer_size, the HID core allows reports up to HID_MAX_BUFFER_SIZE (16384 bytes) to reach the driver. A local user issuing a hidrawSET_REPORT or SET_FEATURE ioctl with an oversized report can overflow the heap buffer with attacker-controlled data.

Critical Impact
A local authenticated user can trigger a kernel heap buffer overflow with controlled length and content, enabling potential privilege escalation, kernel memory corruption, and denial of service on affected Linux systems.

Affected Products

Linux kernel builds including the intel-thc-hid / intel-quickspi driver prior to the fix commits
Systems using Intel Touch Host Controller (THC) HID over SPI touch devices
Distributions shipping vulnerable stable kernel branches referenced in the upstream fixes

Discovery Timeline

2026-09-11 - CVE-2026-89620 published to the National Vulnerability Database
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89620

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the Intel Touch Host Controller HID SPI driver. quickspi_alloc_report_buf() allocates report_buf sized to the device-descriptor-derived max_report_len, which is typically a few hundred bytes for a touch controller. write_cmd_to_txdma() then performs memcpy(write_buf->content, report_buf, report_buf_len) using the caller-supplied length without any bounds check against the allocated size.

Because the driver does not register a max_buffer_size with the HID core, the HID layer default cap of 16384 bytes applies. Userspace can therefore submit reports far larger than the driver's report_buf allocation. The overflow occurs in kernel heap memory, adjacent to other slab allocations, giving an attacker a primitive for corrupting kernel structures.

Root Cause

The root cause is a missing input validation check before a memcpy operation. The driver trusts the length delivered by the HID core without recording or enforcing the allocation size of report_buf. The sibling driver intel-quicki2c already applies this check in quicki2c_init_write_buf(), and hid-goodix-spi received an equivalent fix. The intel-quickspi driver had not adopted the same guard.

Attack Vector

Exploitation requires local access and the ability to open a hidraw device node backed by the affected driver. An attacker with sufficient permission to issue SET_REPORT or SET_FEATUREioctl calls crafts a report larger than max_report_len but within HID_MAX_BUFFER_SIZE. The oversized report is passed through the HID core into write_cmd_to_txdma(), where the unchecked memcpy writes attacker-controlled bytes past the end of the heap allocation. See the upstream fixes for technical details: Kernel commit 6fcefe71, Kernel commit a59cf844, and Kernel commit ee8ad1bb.

Detection Methods for CVE-2026-89620

Indicators of Compromise

Kernel oops, panic, or KASAN slab-out-of-bounds reports referencing write_cmd_to_txdma or intel-quickspi in dmesg.
Unexpected process crashes or SLUB corruption warnings on systems with Intel THC HID SPI touch hardware.
Unusual hidrawioctl activity from non-privileged processes targeting touch controller device nodes.

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to catch the out-of-bounds write during fuzzing or QA of touch input paths.
Audit loaded kernel modules for intel_quickspi and cross-reference against patched kernel versions from your distribution.
Monitor process telemetry for unprivileged processes opening /dev/hidraw* nodes and issuing HIDIOCSFEATURE or HIDIOCSINPUT requests with abnormally large payloads.

Monitoring Recommendations

Collect and centralize dmesg and journald kernel logs to a SIEM for correlation of crash signatures across the fleet.
Alert on repeated segmentation faults or kernel warnings originating on endpoints equipped with Intel THC touch hardware.
Track hidraw device access patterns using endpoint telemetry to detect anomalous local write attempts.

How to Mitigate CVE-2026-89620

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fixes referenced by commits 6fcefe71, a59cf844, and ee8ad1bb.
Apply the corresponding stable-tree backport provided by your Linux distribution vendor.
Restrict permissions on /dev/hidraw* device nodes to trusted users and services only.

Patch Information

The fix records the report_buf allocation size and rejects reports that exceed it before the memcpy. It also sizes the allocation to include the output report header written ahead of the content in the same buffer, so that maximum-sized legitimate reports are still accepted. The corrective changes are available in the mainline and stable kernel trees via Kernel commit 6fcefe71, Kernel commit a59cf844, and Kernel commit ee8ad1bb.

Workarounds

Blacklist the intel_quickspi kernel module on systems that do not require Intel THC HID SPI touch input.
Enforce strict udev rules or ACLs on /dev/hidraw* to prevent unprivileged user access.
Disable Intel Touch Host Controller in system firmware where the touchscreen functionality is not needed.

bash

# Blacklist the vulnerable module until a patched kernel is deployed
echo "blacklist intel_quickspi" | sudo tee /etc/modprobe.d/blacklist-intel-quickspi.conf
sudo update-initramfs -u

# Restrict hidraw access to the input group only
echo 'KERNEL=="hidraw*", MODE="0640", GROUP="input"' | \
  sudo tee /etc/udev/rules.d/90-hidraw-restrict.rules
sudo udevadm control --reload-rules && sudo udevadm trigger