Not yet scoredPublished Sep 11, 2026

CVE-2026-89621HID: mcp2221: validate report size in mcp2221_raw_event()

Updated under an hour ago (Oct 27, 2026, 11:23 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221_raw_event() mcp2221_raw_event() never validates the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3] as the copy length without checking that 4 + data[3] bytes actually exist in the received report. A malicious or misbehaving USB device can send a short report with a large data[3], causing the memcpy to read past the valid report data in the HID transfer buffer and leak uninitialized kernel memory back to userspace through the I2C/SMBus read path. Add a minimum size check at entry and validate that the source range fits within the received report before the copy.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 67a95c21463d066060b0f66d65a75d45bb386ffb before cb38b1f149b7143355b37e86c841acf0076e5c2a; from 67a95c21463d066060b0f66d65a75d45bb386ffb before b2c67dc0e30c308647bbd9b9e5d69a44c9d2733d; from 67a95c21463d066060b0f66d65a75d45bb386ffb before fffcfa367072628c3144cca17d2a3c3c9e50c057; from 67a95c21463d066060b0f66d65a75d45bb386ffb before c1c508e8923911cb458234997e55b7a4b9aa066f; from 67a95c21463d066060b0f66d65a75d45bb386ffb before bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149; from 67a95c21463d066060b0f66d65a75d45bb386ffb before 127de5919820f88a9d55e8371ad4ac49f625f4c5; 67a95c21463d066060b0f66d65a75d45bb386ffb builds before 7c18fb36708a97ff6772825cc087b6d537bbf0d5; 67a95c21463d066060b0f66d65a75d45bb386ffb builds before 2c9a6998c19503626c57a2267bf279e204113079	CNA record

References

References

https://git.kernel.org/stable/c/cb38b1f149b7143355b37e86c841acf0076e5c2a
https://git.kernel.org/stable/c/b2c67dc0e30c308647bbd9b9e5d69a44c9d2733d
https://git.kernel.org/stable/c/fffcfa367072628c3144cca17d2a3c3c9e50c057
https://git.kernel.org/stable/c/c1c508e8923911cb458234997e55b7a4b9aa066f
https://git.kernel.org/stable/c/bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149
https://git.kernel.org/stable/c/127de5919820f88a9d55e8371ad4ac49f625f4c5
https://git.kernel.org/stable/c/7c18fb36708a97ff6772825cc087b6d537bbf0d5
https://git.kernel.org/stable/c/2c9a6998c19503626c57a2267bf279e204113079

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.