PT-2026-64588 · Linux · Linux
CVE-2026-64367
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
goodix hid set raw report() builds a protocol frame in a 128-byte stack
buffer (tmp buf), writing an 11-12 byte header followed by the
caller-supplied report data. The HID core caps report size at
HID MAX BUFFER SIZE (16384) by default, while the driver does not set
hid ll driver.max buffer size and performs no bounds checking before
copying the payload:
memcpy(tmp buf + tx len, buf, len);
A hidraw SET REPORT ioctl with a report larger than ~116 bytes
overflows the stack buffer.
Add a size check after constructing the header, rejecting reports that
would exceed the buffer capacity.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux