{"id":"CVE-2026-72352","state":"PUBLISHED","title":"HID: bpf: Fix hid_bpf_get_data() range check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: Fix hid_bpf_get_data() range check\n\nhid_bpf_get_data() returns a pointer into the HID-BPF context data when\nthe caller-provided offset and size fit inside ctx->allocated_size.\n\nThe current check adds rdwr_buf_size and offset before comparing the\nresult against ctx->allocated_size. Since both values are unsigned, a\nvery large size can wrap the sum below ctx->allocated_size and make the\nhelper return a pointer even though the requested range is not contained\nin the backing buffer.\n\nUse check_add_overflow() to reject wrapped range ends before comparing\nthe requested range end against ctx->allocated_size.","publishedAt":"2026-08-15T05:55:54.809Z","updatedAt":"2026-10-21T12:44:39.607Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","status":"affected","lessThan":"f72176bde0cc0e709e41ab170c71e8f229232af6","versionType":"git"},{"version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","status":"affected","lessThan":"ca373549140dfb386aa2de38364b58441b1f4885","versionType":"git"},{"version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","status":"affected","lessThan":"61a959b82f1aecd6d2d35c208013dd077cac9d10","versionType":"git"},{"version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","status":"affected","lessThan":"f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f","versionType":"git"},{"version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","status":"affected","lessThan":"2d044049421dd48212b28646a850749d4a2d57fa","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hid/bpf/hid_bpf_dispatch.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.3","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hid/bpf/hid_bpf_dispatch.c"]}],"references":["https://git.kernel.org/stable/c/f72176bde0cc0e709e41ab170c71e8f229232af6","https://git.kernel.org/stable/c/ca373549140dfb386aa2de38364b58441b1f4885","https://git.kernel.org/stable/c/61a959b82f1aecd6d2d35c208013dd077cac9d10","https://git.kernel.org/stable/c/f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f","https://git.kernel.org/stable/c/2d044049421dd48212b28646a850749d4a2d57fa"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72352.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72352","state":"PUBLISHED","datePublished":"2026-08-15T05:55:54.809Z","dateUpdated":"2026-10-21T12:44:39.607Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.921Z"},"containers":{"cna":{"title":"HID: bpf: Fix hid_bpf_get_data() range check","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: Fix hid_bpf_get_data() range check\n\nhid_bpf_get_data() returns a pointer into the HID-BPF context data when\nthe caller-provided offset and size fit inside ctx->allocated_size.\n\nThe current check adds rdwr_buf_size and offset before comparing the\nresult against ctx->allocated_size. Since both values are unsigned, a\nvery large size can wrap the sum below ctx->allocated_size and make the\nhelper return a pointer even though the requested range is not contained\nin the backing buffer.\n\nUse check_add_overflow() to reject wrapped range ends before comparing\nthe requested range end against ctx->allocated_size."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","status":"affected","lessThan":"f72176bde0cc0e709e41ab170c71e8f229232af6","versionType":"git"},{"version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","status":"affected","lessThan":"ca373549140dfb386aa2de38364b58441b1f4885","versionType":"git"},{"version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","status":"affected","lessThan":"61a959b82f1aecd6d2d35c208013dd077cac9d10","versionType":"git"},{"version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","status":"affected","lessThan":"f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f","versionType":"git"},{"version":"658ee5a64fcfbbf758447fa3af425729eaabb0dc","status":"affected","lessThan":"2d044049421dd48212b28646a850749d4a2d57fa","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hid/bpf/hid_bpf_dispatch.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.3","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hid/bpf/hid_bpf_dispatch.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f72176bde0cc0e709e41ab170c71e8f229232af6"},{"url":"https://git.kernel.org/stable/c/ca373549140dfb386aa2de38364b58441b1f4885"},{"url":"https://git.kernel.org/stable/c/61a959b82f1aecd6d2d35c208013dd077cac9d10"},{"url":"https://git.kernel.org/stable/c/f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f"},{"url":"https://git.kernel.org/stable/c/2d044049421dd48212b28646a850749d4a2d57fa"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is only reachable through local bpf() syscalls that load BPF_PROG_TYPE_STRUCT_OPS HID-BPF programs and attach them via BPF_LINK_CREATE; per kernel CNA guidance BPF subsystem bugs are Local even though callbacks may later run on HID input.\nAC:L - Once a HID-BPF program is loaded, the attacker fully controls offset and rdwr_buf_size passed to hid_bpf_get_data(); values such as offset=2 with size=~0 reliably wrap the unsigned sum and bypass the check without races or uncontrollable memory layout.\nPR:L - Loading BPF_MAP_TYPE_STRUCT_OPS maps and BPF_PROG_TYPE_STRUCT_OPS programs requires CAP_BPF (sysctl_unprivileged_bpf_disabled blocks unprivileged BPF); per kernel CNA guidance this is Low because CAP_BPF can be delegated via BPF tokens into user namespaces, not only init-namespace root.\nUI:N - The attacker loads and attaches their own HID-BPF program and triggers hid_bpf_get_data() from its callbacks; no separate victim action such as mounting, opening a file, or plugging in a device is required beyond the attacker's own bpf operations.\nS:U - Exploitation corrupts kernel heap memory from within the same kernel security authority to achieve local privilege escalation; it does not inherently cross VM, IOMMU, or container sandbox boundaries as a distinct scope change.\nC:H - The overflow lets BPF code obtain a pointer outside the allocated HID-BPF context buffer and read adjacent kernel heap memory, enabling arbitrary kernel information disclosure and supporting further exploitation primitives.\nI:H - The same out-of-bounds pointer allows arbitrary kernel heap writes through the returned buffer, enabling control of adjacent objects and potential arbitrary code execution in kernel context.\nA:H - Large out-of-bounds reads/writes against kmalloc-backed HID-BPF buffers can corrupt critical kernel structures and cause kernel oops, panic, or hang during HID-BPF callback execution."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-21T12:44:39.607Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72352","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:47:53.495070Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:55:20.122Z"}}]}}}