VulnerabilityPublished 4 Sep 2026Updated 6 Nov 2026

CVE-2026-80781: Linux kernel · HID: core: fix OOB read of field->usage in hid_set_field()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in cbcc0e8dea499e5ca86b583372ccb1815cccc570 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:40 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in cbcc0e8dea499e5ca86b583372ccb1815cccc570, c1d9c16af51cc6ff92a5a062617d3b022dd01078, a38212687519f2a72f43e62dec1348a690412404 +6

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < cbcc0e8dea499e5ca86b583372ccb1815cccc570	Fixed in cbcc0e8dea499e5ca86b583372ccb1815cccc570
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < c1d9c16af51cc6ff92a5a062617d3b022dd01078	Fixed in c1d9c16af51cc6ff92a5a062617d3b022dd01078
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a38212687519f2a72f43e62dec1348a690412404	Fixed in a38212687519f2a72f43e62dec1348a690412404
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a13cdb19fcb223ed41bdab3bab42b98dba87e90b	Fixed in a13cdb19fcb223ed41bdab3bab42b98dba87e90b
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 465544b3d6602cfbdc2305d5cbfb7f4954353b63	Fixed in 465544b3d6602cfbdc2305d5cbfb7f4954353b63
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 5215ea00a747eca34cb2f603cfef91fef76c2558	Fixed in 5215ea00a747eca34cb2f603cfef91fef76c2558

AI-suggested

A fix is available and has been applied in the Linux kernel commits listed as fixedVersions. Users and administrators should update to a Linux kernel version that includes these fixes to remediate the vulnerability. No additional mitigation steps are required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's HID core component allows an out-of-bounds read of the field->usage array in the hid_set_field() function. This occurs because hid_dump_input() is called before a bounds check on the offset, leading to a potential read beyond the allocated array. The issue is fixed by moving the call to hid_dump_input() after the bounds check, ensuring safe pointer dereferencing.

Impact

The vulnerability results in an out-of-bounds read of kernel memory, which can lead to information disclosure or kernel instability. However, there is no indication of known exploits in the wild or direct code execution from this flaw. The impact is limited to reading beyond allocated memory in the HID subsystem.

Summary

The Linux kernel HID core had a flaw in hid_set_field() where the function hid_dump_input() was called with a pointer derived from field->usage + offset before verifying that offset was within bounds. This could cause an out-of-bounds read when offset exceeded field->report_count but was less than field->maxusage, as the usage array is allocated with maxusage entries. A specific caller, picolcd_fb_send_tile(), used offsets unchecked against the field bounds, triggering this issue. The fix involved reordering the code to perform the bounds check before calling hid_dump_input(), preventing any out-of-bounds access.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:40 UTC

Technical details

References

Community reviews

Related threats