CVE-2026-89629: Linux Kernel HID Buffer Overflow Flaw

CVE-2026-89629 Overview

CVE-2026-89629 is an out-of-bounds read vulnerability in the Linux kernel's corsair-void HID driver. The flaw affects the driver's handling of status and firmware events received from Corsair Void headset devices. The driver failed to validate the size of incoming events before parsing them, allowing malformed reports to trigger reads beyond allocated buffers. Upstream maintainers resolved the issue by adding size checks and warnings on unexpected values.

Critical Impact
A malicious or malfunctioning USB/wireless HID device presenting as a Corsair Void headset can trigger kernel memory reads outside the intended buffer, potentially leading to information disclosure or kernel instability.

Affected Products

Linux kernel builds including the corsair-void HID driver
Distributions shipping the vulnerable driver prior to the fixed commits
Systems permitting untrusted HID device attachment

Discovery Timeline

2026-09-11 - CVE-2026-89629 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89629

Vulnerability Analysis

The corsair-void driver in the Linux kernel provides support for Corsair Void wireless headsets over HID. The driver processes two categories of asynchronous events from the device: status events (battery, connection state) and firmware events (version reporting). Both handlers accessed fields inside the incoming HID report without first confirming the report contained enough bytes.

A crafted or malformed event smaller than expected causes the handler to read past the end of the report buffer. The read touches adjacent kernel memory, producing an out-of-bounds read [CWE-125]. Depending on adjacent allocations, the result can be leaked kernel data, incorrect driver state, or a kernel warning and potential fault.

The upstream fix, applied across commits 0329354, 08d8814, and 79465a3, introduces explicit size checks before dereferencing event fields and emits WARN diagnostics when the device sends unexpected sizes.

Root Cause

The root cause is missing input validation on the length of HID event payloads before field access. The driver assumed the device would always send well-formed reports of a fixed minimum size. No boundary check gated the reads, so any shorter payload produced an out-of-bounds access in the kernel address space.

Attack Vector

Exploitation requires the ability to present a HID device to the kernel that identifies as a Corsair Void headset and to send crafted status or firmware events. Realistic scenarios include a physically attached malicious USB device, a compromised wireless dongle, or a virtualized device passed through to a guest. The vulnerability is a local, physical, or proximate attack surface rather than a remote network vector.

No public proof-of-concept exploit is listed in the reference set, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-89629

Indicators of Compromise

Kernel ring buffer entries containing WARN messages originating from the corsair-void driver after applying patched kernels
Unexpected hid-corsair-void module faults, oopses, or repeated device reconnect cycles
USB or Bluetooth event logs showing devices that enumerate as Corsair Void headsets from unknown or unusual sources

Detection Strategies

Audit installed kernel versions against the patched commits 0329354, 08d8814, and 79465a3 to identify unpatched hosts
Monitor dmesg and journalctl -k for driver warnings referencing corsair-void status or firmware events
Correlate HID device enumeration events with subsequent kernel warnings to identify anomalous device behavior

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on driver-emitted warnings
Track USB device attachment events on endpoints where untrusted peripherals may be connected
Baseline expected HID vendor/product IDs on managed endpoints and flag deviations

How to Mitigate CVE-2026-89629

Immediate Actions Required

Update to a Linux kernel that includes the fixes in commits 0329354abba357340ee88452425857f3718b5807, 08d8814521885e67b1bdf6a3036ee264e3e58377, and 79465a30050dad62b3c9e7796368db75dac6fa0d
Apply distribution kernel updates once vendors have backported the fix to supported stable trees
Restrict physical and USB access on systems processing sensitive kernel-resident data

Patch Information

The fix is available upstream in the Linux kernel stable tree. Review the Kernel Git Commit 0329354, Kernel Git Commit 08d8814, and Kernel Git Commit 79465a3 for the corresponding changes to the corsair-void driver. Each commit adds size validation before reading status and firmware event fields.

Workarounds

Blacklist the hid-corsair-void kernel module on systems that do not require Corsair Void headset support
Enforce USB device allowlists using usbguard or equivalent controls to block unknown HID devices
Disable wireless dongles or unbind the driver at runtime with echo -n <device> > /sys/bus/hid/drivers/hid-corsair-void/unbind where feasible

bash

# Blacklist the vulnerable module until patched
echo "blacklist hid_corsair_void" | sudo tee /etc/modprobe.d/blacklist-corsair-void.conf
sudo modprobe -r hid_corsair_void
sudo update-initramfs -u