CVE-2026-31401 Details
Description
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guarantees that the value makes sense.
A buffer overflow vulnerability has been identified in the Linux kernel's HID-BPF implementation, specifically within the hid_hw_request function. This issue arises because the function currently assumes that the return value from dispatch_hid_bpf_raw_requests() is always valid. However, when interacting with HID-BPF, this return value can be arbitrarily large, potentially leading to a buffer overflow. The vulnerability is present in the Linux kernel stable tree.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available on the Linux kernel official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2b658c1c442ec1cd9eec5ead98d68662c40fe645 | kernel.org | Patch |
| https://git.kernel.org/stable/c/73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d6efaa50af62fb0790dd1fd4e7e5506b46312510 | kernel.org | Patch |
| https://git.kernel.org/stable/c/eb57dae20fdf6f3069cdc07821fa3bb46de381d7 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.11, < 6.12.78 >= 6.13, < 6.18.20 >= 6.19, < 6.19.10 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 20, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | kernel.org |
| Apr 3, 2026 | New CVE Received | kernel.org |