In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request As reported by… (CVE-2026-98860)

The vulnerability in the Linux kernel's HID subsystem affected the handling of hardware error codes in BPF programs. When a transport driver returned a negative error code (e.g., -EPIPE), the return value was implicitly promoted to an unsigned size_t type during comparison, causing the negative error to appear as a large positive number. This made the condition (ret > size) true, resulting in the error being treated as a success and the unmodified buffer being copied back. Consequently, BPF programs could process uninitialized or stale data. The issue was fixed by explicitly casting the size variable to ssize_t, ensuring that negative error codes are correctly recognized and handled.

The vulnerability could cause BPF programs in the Linux kernel to operate on uninitialized or stale data due to hardware errors being misinterpreted as successful operations. This could lead to incorrect program behavior or data integrity issues within the kernel's HID subsystem. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this vulnerability by casting the size variable to ssize_t to properly handle negative error codes. Users should apply the official kernel updates that include this fix. No alternative mitigations are indicated.