CVE-2026-89729: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89729 Overview

CVE-2026-89729 is an out-of-bounds write vulnerability in the Linux kernel's HID sensor-hub driver. The flaw exists in the sensor_hub_get_feature() function, which clamps its return value to the caller's buffer size but continues copying field->report_size / 8 bytes per report value. A malicious Human Interface Device (HID) descriptor can advertise a large feature field size while an Industrial I/O (IIO) caller supplies a small stack buffer such as a single s32. This mismatch causes writes past the end of the caller's buffer, leading to kernel memory corruption.

Critical Impact
An attacker with access to attach a malicious USB or Bluetooth HID device can corrupt kernel stack memory, enabling code execution or denial of service.

Affected Products

Linux kernel HID subsystem (drivers/hid/hid-sensor-hub.c)
Kernel builds exposing the sensor-hub driver to IIO consumers
Systems using HID-over-USB, HID-over-Bluetooth, or HID-over-I2C sensor hubs

Discovery Timeline

2026-09-11 - CVE-2026-89729 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89729

Vulnerability Analysis

The Linux kernel HID sensor-hub driver provides an abstraction layer between HID sensor descriptors and IIO consumers. The sensor_hub_get_feature() function retrieves feature report data and copies extracted values into a caller-supplied buffer. The function correctly clamps the returned byte count to the buffer size but fails to clamp the per-value copy loop.

The copy loop iterates over each report value and writes field->report_size / 8 bytes per iteration. When a HID descriptor declares an oversized report_size, the loop writes beyond the caller's buffer boundary. IIO callers frequently pass small stack buffers, including single 32-bit integer variables, making stack corruption the primary exploitation path.

Root Cause

The root cause is inconsistent bounds enforcement between the aggregate return value and the individual copy operations. HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits, but the sensor-hub layer does not reject fields requiring more than one slot per value. The absence of per-copy bounds checking against the remaining buffer space allows attacker-controlled HID descriptors to dictate the write length.

Attack Vector

Exploitation requires the attacker to present a crafted HID descriptor to the kernel. This can occur through a physically connected USB device, a paired Bluetooth HID sensor, or an I2C-HID peripheral. Once the descriptor is parsed and an IIO consumer requests a feature report, the driver writes past the caller's stack buffer using data derived from the malicious descriptor. Successful exploitation can overwrite return addresses or adjacent kernel structures.

No verified public proof-of-concept is available. Refer to the upstream fix commits for the corrected bounds logic, including Kernel Commit 1c0463f0 and Kernel Commit 4145aa14.

Detection Methods for CVE-2026-89729

Indicators of Compromise

Unexpected kernel stack traces referencing sensor_hub_get_feature or hid_sensor_get_report
Kernel panics or KASAN reports flagging out-of-bounds writes in the HID sensor path
New or unrecognized HID sensor devices enumerated in dmesg immediately preceding a crash
Unusual attachment of composite USB or Bluetooth HID devices on servers or workstations with no operational need for sensors

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test environments to surface out-of-bounds writes during HID descriptor fuzzing
Monitor kernel ring buffer entries from the hid and hid-sensor-hub subsystems for parser warnings or malformed report descriptors
Correlate USB and Bluetooth device connect events with subsequent kernel oops or process crash events

Monitoring Recommendations

Log HID device enumeration events including vendor ID, product ID, and report descriptor size
Alert on kernel crashes originating from the HID subsystem within short intervals of new device attachment
Restrict and audit use of USB and Bluetooth HID device authorization on production systems

How to Mitigate CVE-2026-89729

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor-backported updates are available
Disable or unload the hid-sensor-hub module on systems that do not require HID sensor functionality using modprobe -r hid-sensor-hub
Enforce USB device authorization policies to prevent untrusted HID devices from binding to the driver
Restrict Bluetooth HID pairing on servers and shared workstations

Patch Information

The fix rejects feature fields that require more than one __s32 slot per value, guards the total byte count calculation, and clamps each per-value copy to the remaining caller buffer. The corrected code is available across multiple stable branches. Reference commits include Kernel Commit 8bf8aaf2, Kernel Commit 9f43499c, Kernel Commit bc3d72c4, Kernel Commit c5c60260, Kernel Commit c92693f3, and Kernel Commit fa95b141.

Workarounds

Blacklist the hid-sensor-hub module on systems that do not use HID sensors
Use USBGuard or equivalent tooling to enforce an allowlist of approved HID devices
Configure authorized_default on USB controllers to require explicit approval before binding new devices
Disable Bluetooth on systems that do not require it, or restrict pairing to known device addresses

bash

# Blacklist the vulnerable module until patches are deployed
echo 'blacklist hid-sensor-hub' | sudo tee /etc/modprobe.d/cve-2026-89729.conf
sudo modprobe -r hid-sensor-hub

# Require explicit authorization for newly attached USB devices
for host in /sys/bus/usb/devices/usb*; do
    echo 0 | sudo tee "$host/authorized_default"
done