Към съдържанието
Търсене

CVE-2026-90000: Linux

8.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се от съседна мрежа, без особени условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data->input_report_size = hid_report_len(input_report); data->output_report_size = hid_report_len(output_report); alloc_size = data->output_report_size + data->input_report_size; data->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL); data->readReport = data->writeReport + data->output_report_size; but then reads and writes fixed offsets into it. A device declaring a 1-byte output and a 1-byte input report makes hid_report_len() return 2 for each, so alloc_size is 4, while rmi_set_page() -- reached unconditionally at probe time through rmi_input_configured() -- stores writeReport[4] and rmi_hid_read_block() stores writeReport[0..5]. Since readReport lives at writeReport + output_report_size, those stores also corrupt the window the next reply is parsed out of. The read path is worse: the copy length comes from readReport[1], which the device fills in and can be up to 255, and the copy starts at &readReport[2] with no regard for input_report_size, so it runs past the end of the allocation into adjacent slab objects. This does not even need a lying device -- rmi_f01_probe() issues a fixed 21-byte register read, so any device declaring an input report smaller than 23 bytes reads out of bounds even when it answers truthfully. Those bytes become the register values the RMI core acts on: rmi_f01_probe() prints them to the kernel log as the product id and exports them through the mode 0444 sysfs attribute of the same name, and rmi_driver_set_irq_bits() sends them back to the device as the interrupt mask, so an undersized report descriptor leaks heap contents both to unprivileged userspace and to the device itself. The write path has no bound either: rmi_hid_write_block() copies an unboun

    Засегнати продукти

    • Linux Linux: 9fb6bf02e3ad04c20edb8e46536ce3eeda32c736 преди fba600d824597b2a894ecae72fc422c2b8c08f8c; 9fb6bf02e3ad04c20edb8e46536ce3eeda32c736 преди 056ef8e6700b8b6ca11453a9d4bfb1b868a5cd88; 9fb6bf02e3ad04c20edb8e46536ce3eeda32c736 преди 183da103022ec11af55ba9951d2cc171fb6c836b; 9fb6bf02e3ad04c20edb8e46536ce3eeda32c736 преди a8be8bbf0952bb7ff46636ead1896769c381fe55; 9fb6bf02e3ad04c20edb8e46536ce3eeda32c736 преди ab2958e0c94edd63315dd14dc548874cc63a4043; 9fb6bf02e3ad04c20edb8e46536ce3eeda32c736 преди f4cb9c4556dcb593e66dbb855179dbd351dbb053; 9fb6bf02e3ad04c20edb8e46536ce3eeda32c736 преди 48934c2927414a37a7fadeb6091113177c0b2038; 9fb6bf02e3ad04c20edb8e46536ce3eeda32c736 преди 4956993bb3befdf791d71a4952d8d13bcfd44c7b
    • Linux Linux: 3.16; преди 3.16; 5.10.270 до 5.10.*; 5.15.221 до 5.15.*; 6.1.188 до 6.1.*; 6.6.157 до 6.6.*; 6.12.110 до 6.12.*; 6.18.51 до 6.18.*; 7.2.5 до 7.2.*; от 7.3 нататък

    История

    • 16 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-90000: Linux | freedomonline.bg