CVE-2026-31624

Vulnerability

Description

The function s32ton() in the Linux kernel's HID core performs a shift operation using n-1, where n is the report_size value taken directly from a HID device's report descriptor. Although the HID parser bounds report_size to ≤ 256, this permits shift exponents up to 255 on a 32-bit integer, leading to undefined behavior (UB) when building an output report via hid_output_field() or hid_set_field() [1].

Exploitation

Path

An attacker who can connect or emulate a malicious HID device (e.g., via USB or Bluetooth) can craft a report descriptor with an abnormally wide field. No special privileges are required beyond the ability to interact with the HID subsystem. The vulnerable code path is triggered when kernel processes an output report, shifting by a large exponent that causes UB [1].

Impact

Exploiting this results in a medium-severity (CVSS 5.5) issue primarily constituting a denial-of-service (DoS) risk. Undefined behavior can lead to system crashes or memory corruption, although remote exploitation is unlikely device access is attacker's physical or local [1].

Mitigation

The fix clamps report_size to maximum of 32 bits before the shift, mirroring the same clamp already applied to similar function snto32() in commit ec61b41918587 [1]. The patch has been merged into stable kernel branches, and users should apply updates from their distribution's kernel packages.