High 7.8Published Apr 3, 2026

CVE-2026-31401HID: bpf: prevent buffer overflow in hid_hw_request

Updated under an hour ago (Oct 27, 2026, 6:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guarantees that the value makes sense.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-120
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 before d6efaa50af62fb0790dd1fd4e7e5506b46312510; from 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 before 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1; from 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 before eb57dae20fdf6f3069cdc07821fa3bb46de381d7; 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 builds before 2b658c1c442ec1cd9eec5ead98d68662c40fe645	CNA record
linux linux_kernel linux:linux_kernel	from 6.11 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 7.0; 7.0; 7.0; 7.0	NVD

References

References

https://git.kernel.org/stable/c/d6efaa50af62fb0790dd1fd4e7e5506b46312510	patch
https://git.kernel.org/stable/c/73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1	patch
https://git.kernel.org/stable/c/eb57dae20fdf6f3069cdc07821fa3bb46de381d7	patch
https://git.kernel.org/stable/c/2b658c1c442ec1cd9eec5ead98d68662c40fe645	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.