CVE-2026-89621: Linux Kernel HID MCP2221 Info Leak Flaw

CVE-2026-89621 Overview

CVE-2026-89621 is a Linux kernel vulnerability in the HID driver for the Microchip MCP2221 USB-to-I2C/SMBus bridge. The mcp2221_raw_event() function does not validate the size of incoming HID reports before processing them. In the MCP2221_I2C_GET_DATA code path, the driver trusts a device-supplied length field (data[3]) and uses it as a memcpy length without confirming the source range fits within the received report. A malicious or malfunctioning USB device can trigger an out-of-bounds read that leaks uninitialized kernel memory to userspace through the I2C/SMBus read interface.

Critical Impact
A crafted USB device can leak uninitialized kernel memory to userspace via short HID reports processed by the MCP2221 driver.

Affected Products

Linux kernel branches containing the hid-mcp2221 driver prior to the fix commits listed in the kernel.org references
Systems using Microchip MCP2221/MCP2221A USB-to-I2C bridge adapters
Distributions shipping vulnerable stable kernels until backports land

Discovery Timeline

2026-09-11 - CVE-2026-89621 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89621

Vulnerability Analysis

The mcp2221_raw_event() callback receives HID reports from the USB device and dispatches them based on a command byte. For the MCP2221_I2C_GET_DATA path, the driver reads data[3] as the number of I2C payload bytes to copy back to the requesting userspace client. The driver performs the memcpy starting at offset 4 in the report buffer without verifying that 4 + data[3] bytes were actually received from the device.

Because the HID transfer buffer is not zeroed between reports, the out-of-bounds read returns residual kernel heap data. That data then flows through the I2C/SMBus read path to userspace, producing a kernel information disclosure primitive. The fix adds a minimum size check at function entry and validates the source range before the copy.

Root Cause

The root cause is missing input validation on attacker-controlled length metadata from a USB HID device, an Uninitialized Memory Use and Out-of-Bounds Read defect in drivers/hid/hid-mcp2221.c. The driver conflated a device-declared length with a trusted length.

Attack Vector

Exploitation requires the ability to attach or emulate a USB device that presents itself as an MCP2221 HID device. Physical USB access, a malicious peripheral, or a compromised device firmware can supply short HID reports containing a large data[3] value. A userspace process performing an I2C/SMBus read against the exposed adapter then receives leaked kernel memory bytes.

No synthetic exploit code is included. Refer to the upstream kernel commits for the exact validation logic added by the patch: Kernel Commit 127de59 and Kernel Commit cb38b1f.

Detection Methods for CVE-2026-89621

Indicators of Compromise

Presence of USB devices enumerating with MCP2221 vendor/product identifiers on hosts that do not require such hardware
Unexpected hid-mcp2221 module loads in dmesg or journalctl -k on servers and workstations
Userspace processes reading unusually large payloads from /dev/i2c-* interfaces backed by MCP2221 adapters

Detection Strategies

Audit loaded kernel modules with lsmod | grep mcp2221 across the fleet and correlate against approved hardware inventories
Monitor USB device connection events using udev rules or usbguard audit logs to flag new HID devices claiming the MCP2221 interface
Track kernel version and patch level via configuration management to identify hosts still running unfixed hid-mcp2221 code

Monitoring Recommendations

Forward dmesg, udev, and auditd USB events to a central log platform for review
Alert on any I2C/SMBus device node creation on hosts where such interfaces are not part of the expected baseline
Review endpoint telemetry for processes performing raw HID or I2C reads outside sanctioned workloads

How to Mitigate CVE-2026-89621

Immediate Actions Required

Apply the stable kernel updates that include the fix commits referenced by kernel.org for your distribution branch
Restrict physical and logical USB access on servers, kiosks, and shared workstations
Blacklist the hid-mcp2221 module on systems that do not use MCP2221 hardware

Patch Information

The fix adds a minimum size check on entry to mcp2221_raw_event() and validates that 4 + data[3] bytes exist in the received report before the memcpy in the MCP2221_I2C_GET_DATA path. Upstream fixes are tracked in multiple stable branches through the following commits: 127de59, 2c9a699, 7c18fb3, b2c67dc, bdc6a3a, c1c508e, cb38b1f, and fffcfa3. Consume the fix through your distribution's kernel update channel where possible.

Workarounds

Blacklist the vulnerable driver by adding blacklist hid-mcp2221 to /etc/modprobe.d/ on systems that do not need it
Deploy USBGuard policies to allow only known USB device IDs and block unauthorized HID peripherals
Enforce physical port controls, disable unused USB controllers in BIOS/UEFI, and restrict console access on high-value systems

bash

# Configuration example: block the vulnerable driver on hosts that do not need it
echo 'blacklist hid-mcp2221' | sudo tee /etc/modprobe.d/blacklist-mcp2221.conf
sudo rmmod hid_mcp2221 2>/dev/null || true
sudo update-initramfs -u