CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()
A malicious USB device can trigger a buffer over-read in the MCP2221 HID driver, leaking uninitialized kernel memory to userspace.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-89621?
CVE-2026-89621 is a vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: mcp2221: validate report size in mcp2221_raw_event()
mcp2221_raw_event() never validates the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3] as the copy length without checking that 4 + data[3] bytes actually exist in the received report. A malicious or misbehaving USB device can send a short report with a large data[3], causing the memcpy to read past the valid report data in the HID transfer buffer and leak uninitialized kernel memory back to userspace through the I2C/SMBus read path.
Add a minimum size check at entry and validate that the source range fits within the received report before the copy.
Which versions are affected by CVE-2026-89621?
How do I fix CVE-2026-89621?
Apply the vendor's patch.
Is CVE-2026-89621 being exploited?
There is no known exploitation of CVE-2026-89621 in the wild and no public exploit code.
Sources
Also known as AZL-100644, BELL-CVE-2026-89621, DEBIAN-CVE-2026-89621, GHSA-55hm-qvfp-55mj, UBUNTU-CVE-2026-89621.