The Linux kernel's intel-thc-hid intel-quickspi driver had a vulnerability where the function quickspi_get_report did not receive the caller's buffer length and copied the entire device-supplied response into the buffer regardless of its size. Specifically, memcpy(buf, qsdev->report_buf, qsdev->report_len) was called without validating that qsdev->report_len fit within the caller's buffer length, leading to a potential buffer overflow with device-controlled content. The sibling intel-quicki2c driver already implemented length validation, and this fix aligns intel-quickspi with that approach by bounding the GET_REPORT response to the caller's buffer size.

This vulnerability could allow a device-controlled buffer overflow in the kernel space, potentially leading to memory corruption. The impact includes possible kernel crashes or escalation of privileges if exploited. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to bound the GET_REPORT response to the caller's buffer size, preventing buffer overflow. Users should update to the patched kernel version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.