CVE-2026-72352 (GCVE-0-2026-72352)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:43
VLAI
Title
HID: bpf: Fix hid_bpf_get_data() range check
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hid_bpf_get_data() range check hid_bpf_get_data() returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx->allocated_size. The current check adds rdwr_buf_size and offset before comparing the result against ctx->allocated_size. Since both values are unsigned, a very large size can wrap the sum below ctx->allocated_size and make the helper return a pointer even though the requested range is not contained in the backing buffer. Use check_add_overflow() to reject wrapped range ends before comparing the requested range end against ctx->allocated_size.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 658ee5a64fcfbbf758447fa3af425729eaabb0dc , < ca373549140dfb386aa2de38364b58441b1f4885 (git)
Affected: 658ee5a64fcfbbf758447fa3af425729eaabb0dc , < 61a959b82f1aecd6d2d35c208013dd077cac9d10 (git)
Affected: 658ee5a64fcfbbf758447fa3af425729eaabb0dc , < f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f (git)
Affected: 658ee5a64fcfbbf758447fa3af425729eaabb0dc , < 2d044049421dd48212b28646a850749d4a2d57fa (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/bpf/hid_bpf_dispatch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca373549140dfb386aa2de38364b58441b1f4885",
              "status": "affected",
              "version": "658ee5a64fcfbbf758447fa3af425729eaabb0dc",
              "versionType": "git"
            },
            {
              "lessThan": "61a959b82f1aecd6d2d35c208013dd077cac9d10",
              "status": "affected",
              "version": "658ee5a64fcfbbf758447fa3af425729eaabb0dc",
              "versionType": "git"
            },
            {
              "lessThan": "f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f",
              "status": "affected",
              "version": "658ee5a64fcfbbf758447fa3af425729eaabb0dc",
              "versionType": "git"
            },
            {
              "lessThan": "2d044049421dd48212b28646a850749d4a2d57fa",
              "status": "affected",
              "version": "658ee5a64fcfbbf758447fa3af425729eaabb0dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/bpf/hid_bpf_dispatch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: Fix hid_bpf_get_data() range check\n\nhid_bpf_get_data() returns a pointer into the HID-BPF context data when\nthe caller-provided offset and size fit inside ctx-\u003eallocated_size.\n\nThe current check adds rdwr_buf_size and offset before comparing the\nresult against ctx-\u003eallocated_size. Since both values are unsigned, a\nvery large size can wrap the sum below ctx-\u003eallocated_size and make the\nhelper return a pointer even though the requested range is not contained\nin the backing buffer.\n\nUse check_add_overflow() to reject wrapped range ends before comparing\nthe requested range end against ctx-\u003eallocated_size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is only reachable through local bpf() syscalls that load BPF_PROG_TYPE_STRUCT_OPS HID-BPF programs and attach them via BPF_LINK_CREATE; per kernel CNA guidance BPF subsystem bugs are Local even though callbacks may later run on HID input.\nAC:L - Once a HID-BPF program is loaded, the attacker fully controls offset and rdwr_buf_size passed to hid_bpf_get_data(); values such as offset=2 with size=~0 reliably wrap the unsigned sum and bypass the check without races or uncontrollable memory layout.\nPR:L - Loading BPF_MAP_TYPE_STRUCT_OPS maps and BPF_PROG_TYPE_STRUCT_OPS programs requires CAP_BPF (sysctl_unprivileged_bpf_disabled blocks unprivileged BPF); per kernel CNA guidance this is Low because CAP_BPF can be delegated via BPF tokens into user namespaces, not only init-namespace root.\nUI:N - The attacker loads and attaches their own HID-BPF program and triggers hid_bpf_get_data() from its callbacks; no separate victim action such as mounting, opening a file, or plugging in a device is required beyond the attacker\u0027s own bpf operations.\nS:U - Exploitation corrupts kernel heap memory from within the same kernel security authority to achieve local privilege escalation; it does not inherently cross VM, IOMMU, or container sandbox boundaries as a distinct scope change.\nC:H - The overflow lets BPF code obtain a pointer outside the allocated HID-BPF context buffer and read adjacent kernel heap memory, enabling arbitrary kernel information disclosure and supporting further exploitation primitives.\nI:H - The same out-of-bounds pointer allows arbitrary kernel heap writes through the returned buffer, enabling control of adjacent objects and potential arbitrary code execution in kernel context.\nA:H - Large out-of-bounds reads/writes against kmalloc-backed HID-BPF buffers can corrupt critical kernel structures and cause kernel oops, panic, or hang during HID-BPF callback execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:09.954Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca373549140dfb386aa2de38364b58441b1f4885"
        },
        {
          "url": "https://git.kernel.org/stable/c/61a959b82f1aecd6d2d35c208013dd077cac9d10"
        },
        {
          "url": "https://git.kernel.org/stable/c/f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d044049421dd48212b28646a850749d4a2d57fa"
        }
      ],
      "title": "HID: bpf: Fix hid_bpf_get_data() range check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72352",
    "datePublished": "2026-08-15T05:55:54.809Z",
    "dateReserved": "2026-08-09T03:40:39.921Z",
    "dateUpdated": "2026-08-17T05:43:09.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72352",
      "date": "2026-09-20",
      "epss": "0.00175",
      "percentile": "0.07336"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:43:33.000Z",
      "cve": "CVE-2026-72352",
      "id": "msrc_CVE-2026-72352",
      "initial_release_date": "2026-08-23T14:43:33.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "HID: bpf: Fix hid_bpf_get_data() range check",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72352.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/bpf/hid_bpf_dispatch.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ca373549140dfb386aa2de38364b58441b1f4885",
                    "status": "affected",
                    "version": "658ee5a64fcfbbf758447fa3af425729eaabb0dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "61a959b82f1aecd6d2d35c208013dd077cac9d10",
                    "status": "affected",
                    "version": "658ee5a64fcfbbf758447fa3af425729eaabb0dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f",
                    "status": "affected",
                    "version": "658ee5a64fcfbbf758447fa3af425729eaabb0dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2d044049421dd48212b28646a850749d4a2d57fa",
                    "status": "affected",
                    "version": "658ee5a64fcfbbf758447fa3af425729eaabb0dc",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/bpf/hid_bpf_dispatch.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: Fix hid_bpf_get_data() range check\n\nhid_bpf_get_data() returns a pointer into the HID-BPF context data when\nthe caller-provided offset and size fit inside ctx-\u003eallocated_size.\n\nThe current check adds rdwr_buf_size and offset before comparing the\nresult against ctx-\u003eallocated_size. Since both values are unsigned, a\nvery large size can wrap the sum below ctx-\u003eallocated_size and make the\nhelper return a pointer even though the requested range is not contained\nin the backing buffer.\n\nUse check_add_overflow() to reject wrapped range ends before comparing\nthe requested range end against ctx-\u003eallocated_size."
          }
        ],
        "id": "CVE-2026-72352",
        "lastModified": "2026-08-17T06:18:39.290",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:08.633",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2d044049421dd48212b28646a850749d4a2d57fa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/61a959b82f1aecd6d2d35c208013dd077cac9d10"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ca373549140dfb386aa2de38364b58441b1f4885"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f81bc5a709dcbaf2a3bbef4ca7167f93900cc39f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T07:34:35+00:00",
      "cve": "CVE-2026-72352",
      "id": "CVE-2026-72352",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: HID: bpf: Fix hid_bpf_get_data() range check",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72352.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:26:40Z",
      "cve": "CVE-2026-72352",
      "id": "CVE-2026-72352",
      "initial_release_date": "2026-09-01T13:29:38Z",
      "product_status:known_affected": "123",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72352",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72352.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.