Linux Kernel HID Out-of-Bounds Read in Report Handling

CVE-2026-80604 is an out-of-bounds (OOB) read vulnerability in the Linux kernel's Human Interface Device (HID) subsystem that occurs when processing numbered reports with insufficient buffer validation. The flaw exists in hid_get_report(), which unconditionally dereferences data[0] to extract a report ID without first validating that the provided buffer contains at least one byte. This affects any system running a vulnerable Linux kernel that processes HID devices—including desktops, laptops, servers, and embedded systems with USB/Bluetooth input devices. An attacker with local access or the ability to interact with a HID device could trigger this OOB read, potentially leaking kernel memory contents and enabling privilege escalation or denial of service attacks.

Detecting exploitation of this vulnerability requires monitoring for memory access violations and unusual HID device interactions at the kernel level. Casky's platform, powered by Claude AI's extended reasoning capabilities, maps defensive detection patterns to MITRE ATT&CK techniques such as T1005 (Data from Local System) for memory exfiltration attempts and T1499 (Service Exhaustion Denial of Service) for kernel crashes triggered by malformed HID requests. A practitioner would observe findings related to kernel memory disclosure attempts, unexpected HID report processing with zero-length buffers, or kernel panic events correlating with HID device activity. By correlating input validation failures with memory access patterns across the 754 mapped security skills, security teams can identify systems exploiting this vulnerability before privilege escalation or data theft occurs.