PT-2026-64588 · Linux · Linux

CVE-2026-64367

·

Published

2026-07-25

·

Updated

2026-07-25

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
goodix hid set raw report() builds a protocol frame in a 128-byte stack buffer (tmp buf), writing an 11-12 byte header followed by the caller-supplied report data. The HID core caps report size at HID MAX BUFFER SIZE (16384) by default, while the driver does not set hid ll driver.max buffer size and performs no bounds checking before copying the payload:
memcpy(tmp buf + tx len, buf, len);
A hidraw SET REPORT ioctl with a report larger than ~116 bytes overflows the stack buffer.
Add a size check after constructing the header, rejecting reports that would exceed the buffer capacity.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

CVE-2026-64367

Affected Products

Linux