The Linux kernel hid-goodix-spi driver previously lacked proper bounds checking on the size of HID reports copied into a 128-byte stack buffer. The function goodix_hid_set_raw_report() constructs a protocol frame with an 11-12 byte header followed by caller-supplied report data. While the HID core limits report size to 16384 bytes by default, the driver did not set max_buffer_size or validate the payload length before copying it via memcpy, leading to a potential stack buffer overflow when a report larger than about 116 bytes is processed. The vulnerability was fixed by adding a size check after header construction to reject reports exceeding the buffer capacity.

An attacker able to send a crafted HID SET_REPORT ioctl with a report larger than approximately 116 bytes could overflow the 128-byte stack buffer in the hid-goodix-spi driver. This could lead to memory corruption, potentially causing denial of service or arbitrary code execution within kernel context. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to add proper size validation and prevent stack buffer overflow in the hid-goodix-spi driver. Users and administrators should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed from vendor advisory; check the Linux kernel security advisories for the current remediation guidance.