CVE-2026-31624 (GCVE-0-2026-31624)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:42 – Updated: 2026-05-11 22:12
VLAI
Title
HID: core: clamp report_size in s32ton() to avoid undefined shift
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: core: clamp report_size in s32ton() to avoid undefined shift s32ton() shifts by n-1 where n is the field's report_size, a value that comes directly from a HID device. The HID parser bounds report_size only to <= 256, so a broken HID device can supply a report descriptor with a wide field that triggers shift exponents up to 256 on a 32-bit type when an output report is built via hid_output_field() or hid_set_field(). Commit ec61b41918587 ("HID: core: fix shift-out-of-bounds in hid_report_raw_event") added the same n > 32 clamp to the function snto32(), but s32ton() was never given the same fix as I guess syzbot hadn't figured out how to fuzz a device the same way. Fix this up by just clamping the max value of n, just like snto32() does.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: dde5845a529ff753364a6d1aea61180946270bfa , < 932ae5309e53561197aa7d1606c7cf63af10e24f (git)
Affected: dde5845a529ff753364a6d1aea61180946270bfa , < 58386f00af710922cafb0fb69211497beddfaa95 (git)
Affected: dde5845a529ff753364a6d1aea61180946270bfa , < 8a8333237f1f5caab8d4c3d2c2e7578c4263a97f (git)
Affected: dde5845a529ff753364a6d1aea61180946270bfa , < ea363a34086ddb4231adc581a7f36c39ec154bfc (git)
Affected: dde5845a529ff753364a6d1aea61180946270bfa , < 97014719bb8fccb1ffcbbc299e84b1f11b114195 (git)
Affected: dde5845a529ff753364a6d1aea61180946270bfa , < 69c02ffde6ed4d535fa4e693a9e572729cad3d0d (git)
Create a notification for this product.
Linux Linux Affected: 2.6.20
Unaffected: 0 , < 2.6.20 (semver)
Unaffected: 6.6.136 , ≤ 6.6.* (semver)
Unaffected: 6.12.83 , ≤ 6.12.* (semver)
Unaffected: 6.18.24 , ≤ 6.18.* (semver)
Unaffected: 6.19.14 , ≤ 6.19.* (semver)
Unaffected: 7.0.1 , ≤ 7.0.* (semver)
Unaffected: 7.1-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "932ae5309e53561197aa7d1606c7cf63af10e24f",
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "versionType": "git"
            },
            {
              "lessThan": "58386f00af710922cafb0fb69211497beddfaa95",
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "versionType": "git"
            },
            {
              "lessThan": "8a8333237f1f5caab8d4c3d2c2e7578c4263a97f",
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "versionType": "git"
            },
            {
              "lessThan": "ea363a34086ddb4231adc581a7f36c39ec154bfc",
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "versionType": "git"
            },
            {
              "lessThan": "97014719bb8fccb1ffcbbc299e84b1f11b114195",
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "versionType": "git"
            },
            {
              "lessThan": "69c02ffde6ed4d535fa4e693a9e572729cad3d0d",
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.20"
            },
            {
              "lessThan": "2.6.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1-rc1",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: clamp report_size in s32ton() to avoid undefined shift\n\ns32ton() shifts by n-1 where n is the field\u0027s report_size, a value that\ncomes directly from a HID device.  The HID parser bounds report_size\nonly to \u003c= 256, so a broken HID device can supply a report descriptor\nwith a wide field that triggers shift exponents up to 256 on a 32-bit\ntype when an output report is built via hid_output_field() or\nhid_set_field().\n\nCommit ec61b41918587 (\"HID: core: fix shift-out-of-bounds in\nhid_report_raw_event\") added the same n \u003e 32 clamp to the function\nsnto32(), but s32ton() was never given the same fix as I guess syzbot\nhadn\u0027t figured out how to fuzz a device the same way.\n\nFix this up by just clamping the max value of n, just like snto32()\ndoes."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:12:24.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/932ae5309e53561197aa7d1606c7cf63af10e24f"
        },
        {
          "url": "https://git.kernel.org/stable/c/58386f00af710922cafb0fb69211497beddfaa95"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a8333237f1f5caab8d4c3d2c2e7578c4263a97f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea363a34086ddb4231adc581a7f36c39ec154bfc"
        },
        {
          "url": "https://git.kernel.org/stable/c/97014719bb8fccb1ffcbbc299e84b1f11b114195"
        },
        {
          "url": "https://git.kernel.org/stable/c/69c02ffde6ed4d535fa4e693a9e572729cad3d0d"
        }
      ],
      "title": "HID: core: clamp report_size in s32ton() to avoid undefined shift",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31624",
    "datePublished": "2026-04-24T14:42:41.655Z",
    "dateReserved": "2026-03-09T15:48:24.124Z",
    "dateUpdated": "2026-05-11T22:12:24.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31624",
      "date": "2026-05-26",
      "epss": "0.00014",
      "percentile": "0.02902"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31624\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-24T15:16:41.697\",\"lastModified\":\"2026-04-28T14:02:38.647\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nHID: core: clamp report_size in s32ton() to avoid undefined shift\\n\\ns32ton() shifts by n-1 where n is the field\u0027s report_size, a value that\\ncomes directly from a HID device.  The HID parser bounds report_size\\nonly to \u003c= 256, so a broken HID device can supply a report descriptor\\nwith a wide field that triggers shift exponents up to 256 on a 32-bit\\ntype when an output report is built via hid_output_field() or\\nhid_set_field().\\n\\nCommit ec61b41918587 (\\\"HID: core: fix shift-out-of-bounds in\\nhid_report_raw_event\\\") added the same n \u003e 32 clamp to the function\\nsnto32(), but s32ton() was never given the same fix as I guess syzbot\\nhadn\u0027t figured out how to fuzz a device the same way.\\n\\nFix this up by just clamping the max value of n, just like snto32()\\ndoes.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.20.1\",\"versionEndExcluding\":\"6.6.136\",\"matchCriteriaId\":\"098695E6-95CE-401B-AC16-CEBD793B4DF1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.83\",\"matchCriteriaId\":\"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.24\",\"matchCriteriaId\":\"8126B8B8-6D0B-4443-86C1-672AEE893555\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.14\",\"matchCriteriaId\":\"D6A8A074-BBF4-4803-ABED-519A839435BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\",\"versionEndExcluding\":\"7.0.1\",\"matchCriteriaId\":\"9B5888AB-7403-4335-89E4-21CC0B48366A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.20:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"5AE1560A-DECA-4BC6-87F6-F3F9ED544840\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/58386f00af710922cafb0fb69211497beddfaa95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69c02ffde6ed4d535fa4e693a9e572729cad3d0d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a8333237f1f5caab8d4c3d2c2e7578c4263a97f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/932ae5309e53561197aa7d1606c7cf63af10e24f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97014719bb8fccb1ffcbbc299e84b1f11b114195\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ea363a34086ddb4231adc581a7f36c39ec154bfc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.