CVE-2026-23178

Vulnerability

Details

CVE-2026-23178 is a buffer overflow vulnerability in the Linux kernel's HID subsystem, specifically in the i2c_hid_get_report() function of the i2c-hid driver. The function uses i2c_hid_xfer to read recv_len + sizeof(__le16) bytes of data into a fixed-size buffer (ihid->rawbuf). The recv_len value originates from userspace via the hidraw driver and is only bounded by the default HID_MAX_BUFFER_SIZE (16384 bytes) unless a driver sets a specific max_buffer_size, which the i2c-hid driver does not. However, ihid->bufsize is determined at runtime based on the maximum report size of the device, which can be much smaller than 16384 bytes.

Exploitation

An attacker with root access to a hidraw device can supply a recv_len value larger than ihid->bufsize - sizeof(__le16), causing a heap-based buffer overflow when i2c_hid_xfer writes data into rawbuf. The vulnerability is exploitable only by users with CAP_SYS_ADMIN (typically root) and requires access to a HID device. No user interaction is needed beyond the attacker possessing the necessary privileges.

Impact

Successful exploitation can corrupt kernel heap memory, potentially leading to a denial of service (system crash or hang) or, with further memory manipulation, privilege escalation. However, the official description notes that access to hidraw devices requires root, reducing the practical impact.

Mitigation

The fix, introduced in two stable kernel commits [1][2], truncates recv_len to ihid->bufsize - sizeof(__le16) before the transfer, preventing the overflow. Users should apply the latest stable kernel updates containing this patch. No CVSS v3 vector string is provided, but the High severity (7.8) indicates significant risk if exploitation conditions are met.