CVE-2026-64367 Details
Description
In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack buffer (tmp_buf), writing an 11-12 byte header followed by the caller-supplied report data. The HID core caps report size at HID_MAX_BUFFER_SIZE (16384) by default, while the driver does not set hid_ll_driver.max_buffer_size and performs no bounds checking before copying the payload: memcpy(tmp_buf + tx_len, buf, len); A hidraw SET_REPORT ioctl with a report larger than ~116 bytes overflows the stack buffer. Add a size check after constructing the header, rejecting reports that would exceed the buffer capacity. Discovered by Atuin - Automated Vulnerability Discovery Engine.
A stack buffer overflow vulnerability has been identified in the Linux kernel HID Goodix SPI driver. The issue arises in the 'goodix_hid_set_raw_report()' function, which constructs a protocol frame using a 128-byte stack buffer. The function writes an 11-12 byte header followed by caller-supplied report data. While the HID core limits report size to a maximum of 16,384 bytes by default, the Goodix driver does not enforce this limit and fails to validate the length of the incoming data before copying it into the buffer. As a result, a 'hidraw SET_REPORT' ioctl command with a report larger than approximately 116 bytes can overflow the stack buffer, potentially leading to arbitrary code execution.
The vulnerability has been addressed by adding a size check in the 'goodix_hid_set_raw_report()' function. Users should update to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/835fcc8655569737e3f057d42875a96259db74c2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ad47ad624f2fce0bc44bbadb664242461a97d774 | kernel.org | Patch |
| https://git.kernel.org/stable/c/dae1d000ddfd5c2140b036e47fff0c497ae9c64b | kernel.org | Patch |
| https://git.kernel.org/stable/c/db0a0768d09273aadadeb76730cd658d720333a4 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.12, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | Initial Analysis | [email protected] |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |