CVE-2026-80781 HID: core: fix OOB read of field->usage in hid_set_field()

What is CVE-2026-80781?

CVE-2026-80781 is a memory corruption vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: fix OOB read of field->usage in hid_set_field()

hid_set_field() hands field->usage + offset to hid_dump_input() before the guard that bounds offset:

hid_dump_input(field->report->device, field->usage + offset, value);

if (offset >= field->report_count) { hid_err(...); return -1; }

Under CONFIG_DEBUG_FS hid_dump_input() dereferences that pointer, with buf = hid_resolv_usage(usage->hid, NULL). The usage[] array is allocated inline with the hid_field in hid_register_field() and holds field->maxusage entries, so an offset past it reads off the end of the kvzalloc()ed allocation and into a neighbouring object. Had the guard run first, offset < report_count <= maxusage would already have confined the pointer to the array.

A caller supplies such an offset today. picolcd_fb_send_tile() validates only report->maxfield before issuing hid_set_field(report->field[0], 11 + i, ...) for i = 0..31, so its offsets are fixed at 11..42 and are never checked against the bound field. When the device registers that field with fewer usages, the framebuffer deferred-io work drives the read on every tile. KASAN reports a 4-byte slab-out-of-bounds read in hid_dump_input() below hid_set_field(), and the same boot logs "offset (1) exceeds report_count (1)" from the guard that runs only afterwards.

Move the hid_dump_input() call below the guard. Because field->maxusage >= field->report_count, the guard then establishes that field->usage + offset lies inside the array before it is dereferenced, for every caller and without changing behaviour on the valid path.

Discovered by XBOW, triaged by Baul Lee <[email protected]>

Which versions are affected by CVE-2026-80781?

How do I fix CVE-2026-80781?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-80781 being exploited?

There is no known exploitation of CVE-2026-80781 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-99407, BELL-CVE-2026-80781, DEBIAN-CVE-2026-80781, GHSA-4wjj-fc9c-xhfj, UBUNTU-CVE-2026-80781.