CVE-2026-31624 Details

A vulnerability exists in the Linux kernel's HID (Human Interface Device) subsystem, specifically within the s32ton function. This issue arises because s32ton shifts data by n-1, where n is the report size obtained from a HID device. The HID parser restricts report size to a maximum of 256, allowing a malfunctioning HID device to present a report descriptor with an excessively wide field. This can lead to undefined behavior by causing shift operations on a 32-bit integer that exceed safe limits, particularly when output reports are processed through hid_output_field or hid_set_field. Although a previous commit addressed similar shift-out-of-bounds issues in another function, s32ton was overlooked. The vulnerability has been patched by adding a clamp to limit the maximum shift value, ensuring safer handling of report sizes.

Users can apply the patch included in the Linux kernel stable release that addresses this vulnerability. Instructions for downloading the patched version are available on the Linux kernel official website.